// Microsoft Defender XDR; research leads, not a confirmed malicious-IP list.
// Replace device scope and select a time window relevant to the source evidence.
let Start = ago(7d);
let End = now();
let TargetDevices = dynamic(["REPLACE_WITH_DEVICE_ID"]);
let ReportedIPs = dynamic(["91.219.237.110", "185.146.232.3", "96.9.125.59", "5.175.221.206"]);
DeviceNetworkEvents
| where Timestamp between (Start .. End)
| where DeviceId in (TargetDevices)
| where RemoteIP in (ReportedIPs)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Events=count(),
    Processes=make_set(InitiatingProcessFileName, 10), Actions=make_set(ActionType, 10)
    by DeviceId, DeviceName, RemoteIP, RemotePort
| order by LastSeen desc
| take 100