File Properties
Query
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName contains "rclone" or FileName contains "rclone"
or ProcessVersionInfoFileDescription contains "Rsync"Explanation
The query is searching for events related to a device's processes. It filters the events based on whether the original file name or file name contains "rclone", or if the file description contains "Rsync".
Details
Ali Hussein
Released: September 12, 2023
Tables
DeviceProcessEvents
Keywords
DeviceProcessEventsProcessVersionInfoOriginalFileNameFileNameProcessVersionInfoFileDescriptionRsync
Operators
|wherecontainsor