// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel DeviceFileEvents: requires Defender event ingestion and read permission.
// In Sentinel use TimeGenerated; Defender Advanced Hunting uses Timestamp instead.
// Markers are leads described in the supplied RST/GTIG reference, not proof of ARTEX.
let TargetDevice = "REPLACE_WITH_DEFENDER_DEVICE_ID";
DeviceFileEvents
| where TimeGenerated between (ago(24h) .. now())
| where DeviceId == TargetDevice
| where FileName startswith "artex-probe-"
    or FolderPath matches regex @"(?i)[\\/]artx[0-9a-z]*(?:[\\/]|$)"
| project TimeGenerated, DeviceId, ActionType, FileName, FolderPath,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
| take 100