// Microsoft Defender XDR Advanced Hunting. Read-only; not live-tested.
// Replace both values with case evidence. No live IOC is supplied here.
let TargetDevice = "REPLACE_WITH_DEVICE_ID";
let ConfirmedIP = "REPLACE_WITH_CONFIRMED_REMOTE_IP";
DeviceNetworkEvents
| where Timestamp between (ago(24h) .. now())
| where DeviceId == TargetDevice and RemoteIP == ConfirmedIP
| project Timestamp, DeviceId, DeviceName, ActionType, RemoteIP, RemotePort,
    RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| order by Timestamp desc
| take 500