// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Which devices open SSH, web-client or console sessions to your ESXi hosts and vCenter?
// Only admin jump hosts should. Every other device in the result is a path an attacker could use to reach the hypervisors.
let Since = ago(30d);
let ManagementSubnet = "REPLACE_WITH_MANAGEMENT_SUBNET_CIDR";
let JumpHosts = dynamic(["REPLACE_WITH_ADMIN_JUMP_HOST_1", "REPLACE_WITH_ADMIN_JUMP_HOST_2"]);
DeviceNetworkEvents
| where Timestamp > Since
| where ActionType in ("ConnectionSuccess", "ConnectionAttempt")
| where RemotePort in (22, 443, 902, 5480, 9443)
| where ipv4_is_in_range(RemoteIP, ManagementSubnet)
| where not(DeviceName in~ (JumpHosts))
| summarize Connections = count(), Ports = make_set(RemotePort), Processes = make_set(InitiatingProcessFileName, 10),
    Accounts = make_set(InitiatingProcessAccountName, 10), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, RemoteIP
| order by Connections desc
| take 500