// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// With drive sharing on, files a remote server puts on your PC are written locally by the Remote Desktop client.
// mstsc.exe or msrdc.exe writing programs, scripts or shortcuts, or anything into a Startup folder, is how a hostile server would plant a backdoor.
let Since = ago(60d);
let Risky = dynamic([".exe", ".dll", ".scr", ".ps1", ".bat", ".cmd", ".vbs", ".js", ".hta", ".lnk", ".msi"]);
DeviceFileEvents
| where Timestamp > Since
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName in~ ("mstsc.exe", "msrdc.exe")
| extend Extension = tolower(strcat(".", tostring(split(FileName, ".")[-1])))
| where Extension in (Risky) or FolderPath contains @"\Start Menu\Programs\Startup"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
    ActionType, FolderPath, FileName, SHA1
| order by Timestamp desc