Outbound WebDAV DavWWWRoot traffic from control.exe or explorer.exe to remote se
Detects outbound network connections made by control.exe or explorer.exe to known campaign domains/IP addresses or utilizing a DavWWWRoot WebDAV path, which is indicative of potential command and control communication or data exfiltration.
Microsoft Sentinel (KQL)
