DeviceFileEvents
| where Timestamp > ago(1d)
| where ActionType == "FileCreated"
| where FileName endswith_any (".iso", ".img", ".vhd", ".vhdx")
| where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\Desktop\\", "\\AppData\\")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessAccountName, SHA256
| sort by Timestamp desc