Scheduled task launching control.exe from remote WebDAV DavWWWRoot path
Detects the creation of scheduled tasks using schtasks.exe or PowerShell where the task action executes control.exe referencing a remote WebDAV DavWWWRoot path, a technique often used for credential theft or proxy execution.
Microsoft Sentinel (KQL)
