Wmi1
Query
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == "135"
| where ActionType == "ConnectionSuccess"
| where Protocol == "Tcp"
| where InitiatingProcessAccountName != @"system"
| where InitiatingProcessAccountName != @"network service"
| where InitiatingProcessAccountName !contains "$"
| summarize count() by InitiatingProcessAccountName
| sort by count_ descExplanation
This query is looking at a dataset called DeviceNetworkEvents. It filters the events to only include those that occurred within the last 24 hours, had a remote port of 135, a successful connection action, and used the TCP protocol. It then excludes events where the initiating process account name is "system", "network service", or contains a dollar sign. The query then summarizes the count of events for each unique initiating process account name and sorts the results in descending order of the count.