// Microsoft Defender XDR / Defender for Endpoint: DeviceProcessEvents.
// Replace the DeviceId list; correlate matches with package, file and network evidence.
let Start = datetime(2026-10-29T09:00:00Z);
let End = datetime(2026-10-31T00:00:00Z);
let TargetDevices = dynamic(["REPLACE_WITH_DEVICE_ID"]);
DeviceProcessEvents
| where Timestamp between (Start .. End)
| where DeviceId in (TargetDevices)
| where FileName in~ ("ssh", "ssh.exe", "autossh", "autossh.exe")
| where ProcessCommandLine contains "134.209.82.225"
    or ProcessCommandLine contains ":0:localhost:22"
| project Timestamp, DeviceId, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| take 100