// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Archive, sync and file-transfer tools started on file servers: the staging and exfiltration steps of a share theft.
// List your file servers, including those at overseas subsidiaries, in FileServers.
let Since = ago(30d);
let FileServers = dynamic(["REPLACE_WITH_FILE_SERVER_1", "REPLACE_WITH_FILE_SERVER_2"]);
let Tools = dynamic(["7z.exe", "7za.exe", "7zg.exe", "rar.exe", "winrar.exe", "makecab.exe", "rclone.exe",
    "megasync.exe", "megacmd.exe", "winscp.exe", "filezilla.exe", "pscp.exe", "restic.exe"]);
DeviceProcessEvents
| where Timestamp > Since
| where DeviceName has_any (FileServers)
| where FileName in~ (Tools) or ProcessVersionInfoOriginalFileName in~ (Tools)
| project Timestamp, DeviceName, AccountDomain, AccountName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp asc
| take 1000