Remote UNC/WebDAV Path Mounting via Pushd
Detects the use of 'pushd' via cmd.exe, powershell.exe, or pwsh.exe to mount remote UNC or WebDAV paths. This command allows users to map a network share to a temporary drive letter and change the current working directory, which is frequently used by adversaries to access remote shares or stage tools.
Microsoft Sentinel (KQL)
