// Microsoft Defender XDR / Defender for Endpoint: DeviceNetworkEvents.
// Replace the DeviceId list. This historical UTC window is a starting point;
// extend the investigation window for delayed activation or persistence.
let Start = datetime(2026-10-29T09:00:00Z);
let End = datetime(2026-10-31T00:00:00Z);
let TargetDevices = dynamic(["REPLACE_WITH_DEVICE_ID"]);
DeviceNetworkEvents
| where Timestamp between (Start .. End)
| where DeviceId in (TargetDevices)
| where RemoteIP == "134.209.82.225"
| where RemotePort in (22, 8099)
| project Timestamp, DeviceId, DeviceName, ActionType, RemoteIP, RemotePort,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| take 100