// Illustrative; not run against live data. CrowdStrike Falcon (LogScale / Next-Gen SIEM).
// Programs, scripts, shortcuts and installers written to disk by the Remote Desktop client.
// With drive sharing on, this is what a remote server's writes to your PC look like.
#event_simpleName=/^(PEFileWritten|NewExecutableWritten|ScriptFileWritten|LnkFileWritten|MsiFileWritten)$/
| ContextBaseFileName=/^(mstsc|msrdc)\.exe$/i
| groupBy([aid, #event_simpleName, TargetFileName], function=[count(as=writes), max(@timestamp, as=last_seen)])