WebDAV outbound connection to external host from AOMEI update client
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
Microsoft Sentinel (KQL)
