File Properties
Query
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName contains "rclone" or FileName contains "rclone"
or ProcessVersionInfoFileDescription contains "Rsync"Explanation
The query is searching for events related to a device's processes. It filters the events based on whether the original file name or file name contains "rclone", or if the file description contains "Rsync".