// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Which PCs hold Remote Desktop connection (.rdp) files, and did any come from onamae.com?
// Open each file found in Notepad: drivestoredirect:s:* means every local drive is shared with the server.
DeviceFileEvents
| where Timestamp > ago(90d)
| where FileName endswith ".rdp"
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| extend FromOnamae = FileOriginUrl contains "onamae" or FileOriginReferrerUrl contains "onamae"
| summarize Files = make_set(FolderPath, 10), Origins = make_set(FileOriginUrl, 10),
    FromOnamae = max(toint(FromOnamae)), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessAccountName
| order by FromOnamae desc, LastSeen desc