Scheduled task launching explorer.exe against WebDAV server (WebClient priming)
Detects scheduled task creation events where the action uses explorer.exe to access a remote URL or WebDAV resource (such as DavWWWRoot, http://, https://, or SSL paths) or specific threat intelligence IOC hosts. This technique is often used for WebClient priming and forced authentication to capture credentials.
Microsoft Sentinel (KQL)
