// Illustrative; not run against live data. CrowdStrike Falcon (LogScale / Next-Gen SIEM).
// Endpoints opening Remote Desktop sessions to public addresses. Onamae.com Desktop Cloud users connected this way.
// Check the field names in your tenant before relying on an empty result.
#event_simpleName=NetworkConnectIP4 RemotePort=3389
| !cidr(field="RemoteAddressIP4", subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10"])
| groupBy([aid, RemoteAddressIP4], function=[count(as=connections), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])