Rundll32 executes DLL from WebDAV UNC share via pf.ch/verification.google export

Arnold Chan@slaz

•updated 27 days ago•2•0•4

Detects execution of rundll32.exe with command-line arguments involving 'DavWWWRoot' and external domains ('pf.ch' or 'verification.google'), which is characteristic of attempts to force remote WebDAV authentication or execute malicious code via network-hosted resources.