// Illustrative hunt; not executed in a live Sentinel or Falcon tenant.
// Sentinel Defender network ingestion; TimeGenerated is the Sentinel timestamp column.
// A shared callback service is not an IOC by itself. One device, last 24h, at most 100 events.
let TargetDevice = "REPLACE_WITH_DEFENDER_DEVICE_ID";
DeviceNetworkEvents
| where TimeGenerated between (ago(24h) .. now())
| where DeviceId == TargetDevice
| extend Host=tolower(extract(@"^(?:https?://)?([^/:]+)",1,tostring(RemoteUrl)))
| where Host == "webhook.site" or Host endswith ".webhook.site"
| project TimeGenerated, DeviceId, ActionType, RemoteUrl, RemoteIP, RemotePort,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessUniqueId
| order by TimeGenerated desc
| take 100