AOMEI ABNotify.exe outbound WebDAV/SMB to external host (NTLM coercion, UNC7017)
Detects outbound network connections from the AOMEI updater process (ABNotify.exe) to public IPs over SMB or WebDAV ports (445, 80, 8080, 443), or connections to a known actor IP.
Microsoft Sentinel (KQL)
