let RATProcesses = dynamic(["AnyDesk.exe", "TeamViewer.exe", "ScreenConnect.WindowsClient.exe", "ConnectWiseControl.Client.exe", "client32.exe", "Splashtop.exe", "RemotePC.exe", "LogMeIn.exe", "GoToAssist.exe", "rustdesk.exe", "meshagent.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ (RATProcesses) or ProcessVersionInfoProductName has_any ("AnyDesk", "TeamViewer", "ScreenConnect", "NetSupport", "Splashtop", "RustDesk")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc