Attempt to Mount a Remote WebDav Share

process where event.action == "start" and
 (
  (process.name : "explorer.exe" and process.args : "\\\\*@*") or
  (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*" and process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "mshta.exe", "msiexec.exe")) or 
  (process.name : "net.exe" and process.args : "use" and 
   ((process.args : ("http*:*", "*webdav*") and process.args : "/user*@*") or process.command_line : "*\\\\*@ssl\\*") and not process.command_line : "*//localhost*") or
  (process.name : ("expand.exe", "xcopy.exe", "cmd.exe") and process.args : ("\\\\webdav*", "*DavWWWRoot*"))
 ) and
 not (process.parent.name : "rundll32.exe" and process.parent.args : "?:\\Program Files\\Microsoft Office\\root\\Office16\\MLCFG32.CPL") and
 not process.parent.executable : ("C:\\Program Files\\Microsoft Office\\root\\Office16\\WINPROJ.EXE",
                                  "D:\\SF-Deploy\\Console\\Console.exe",
                                  "C:\\Program Files\\WindowsApps\\MyCaseInc.MyCaseFileSync_*\\app\\MyCase Desktop.exe",
                                  "C:\\Program Files\\Microsoft Office\\root\\Office16\\OUTLOOK.EXE") and
 not (process.name : "xcopy.exe" and process.args : "\\\\*.sharepoint.com\\DavWWWRoot\\sites\\*")