// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Which PCs open Remote Desktop sessions to servers on the internet? Onamae.com Desktop Cloud users connected this way.
// A corporate fleet rarely needs outbound RDP to public addresses, so every row deserves an owner and a reason.
DeviceNetworkEvents
| where Timestamp > ago(60d)
| where RemotePort == 3389 and RemoteIPType == "Public"
| where ActionType in ("ConnectionSuccess", "ConnectionAttempt")
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName
| order by LastSeen desc