WebDAV Cookie Process via Rundll32

Chaitanya B B@mralien

•updated Jul 11, 2025•3•1•27

Detects the use of rundll32.exe to set WebDAV cookies, which can be indicative of forced authentication attempts or other malicious network activity. This technique is often used by adversaries to capture NTLM hashes by tricking a system into authenticating to a malicious server.