// Microsoft Defender XDR; behavioral triage, not a malware verdict.
let Start = ago(7d);
let End = now();
let TargetDevices = dynamic(["REPLACE_WITH_DEVICE_ID"]);
DeviceProcessEvents
| where Timestamp between (Start .. End)
| where DeviceId in (TargetDevices)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "conhost.exe", "ftp.exe")
| where ProcessCommandLine contains "ftp"
| where ProcessCommandLine contains "|" or ProcessCommandLine contains "conhost"
| project Timestamp, DeviceId, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| take 100