// remote access tool monitoring
let DangerTools = pack_array(
    "AnyDesk",
    "Netscan",
    "PCHunter"
    "PSExec", //info on this one located here: https://learn.microsoft.com/en-us/sysinternals/downloads/psexec not to be confused with internal powershell command line
    "SCP"
    "Softperfect Network Scanner"
    "Teamviewer"
    "QuickAssist"
);
DeviceEvents
| where InitiatingProcessFileName has_any (DangerTools)
    or FileName has_any (DangerTools)
    or InitiatingProcessParentFileName has_any (DangerTools)
| summarize any(Timestamp, DeviceName, ActionType, FileName, FileSize, RemoteIP, InitiatingProcessSHA1, InitiatingProcessSHA256, InitiatingProcessMD5, InitiatingProcessFileName, InitiatingProcessFileSize, InitiatingProcessFolderPath, InitiatingProcessId, InitiatingProcessCommandLine, InitiatingProcessCreationTime, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountSid, InitiatingProcessParentFileName, AdditionalFields, IsProcessRemoteSession, ReportId) by DeviceId
| project Timestamp = any_Timestamp, DeviceId, DeviceName = any_DeviceName, FileName = any_FileName, FileSize = any_FileSize, RemoteIP=any_RemoteIP, InitiatingProcessSHA1 =any_InitiatingProcessSHA1, InitiatingProcessSHA256=any_InitiatingProcessSHA256, InitiatingProcessMD5=any_InitiatingProcessMD5, InitiatingProcessFileName=any_InitiatingProcessFileName, InitiatingProcessFileSize=any_InitiatingProcessFileSize, InitiatingProcessFolderPath=any_InitiatingProcessFolderPath, InitiatingProcessId=any_InitiatingProcessId, InitiatingProcessCommandLine=any_InitiatingProcessCommandLine, InitiatingProcessCreationTime=any_InitiatingProcessCreationTime, InitiatingProcessAccountDomain=any_InitiatingProcessAccountDomain, InitiatingProcessAccountName=any_InitiatingProcessAccountName, InitiatingProcessAccountSid=any_InitiatingProcessAccountSid, InitiatingProcessParentFileName=any_InitiatingProcessParentFileName, AdditionalFields=any_AdditionalFields, IsProcessRemoteSession=any_IsProcessRemoteSession, ReportId=any_ReportId
| sort by Timestamp desc