// Microsoft Defender XDR Advanced Hunting. Read-only; not live-tested.
// Triage ranking only: file-event counts do not prove encryption.
let TargetDevice = "REPLACE_WITH_DEVICE_ID";
DeviceFileEvents
| where Timestamp between (ago(1h) .. now())
| where DeviceId == TargetDevice
| where ActionType in ("FileModified", "FileRenamed", "FileDeleted")
| summarize EventCount=count(), DistinctNames=dcount(FileName),
    ExampleNames=make_set(FileName, 10)
    by DeviceId, DeviceName, bin(Timestamp, 5m), ActionType, InitiatingProcessFileName
| order by EventCount desc, Timestamp desc
| take 200