DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 3389
| where ActionType == "ConnectionSuccess"
| where not(ipv4_is_private(RemoteIP))
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, InitiatingProcessFileName
| sort by Timestamp desc