Rclone
Query
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "rclone.exe"Explanation
This query is searching for events related to a specific device network activity. It filters the events to only include those where the initiating process file name contains "rclone.exe".