WebDAV Remote Share Mounting
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
Microsoft Sentinel (KQL)
