Query Details
File Properties
Query
DeviceProcessEvents | where ProcessVersionInfoOriginalFileName contains "rclone" or FileName contains "rclone" or ProcessVersionInfoFileDescription contains "Rsync"
Explanation
The query is searching for events related to a device's processes. It filters the events based on whether the original file name or file name contains "rclone", or if the file description contains "Rsync".
Details
Ali Hussein
Released: September 12, 2023
Tables
DeviceProcessEvents
Keywords
DeviceProcessEvents,ProcessVersionInfoOriginalFileName,FileName,ProcessVersionInfoFileDescription,Rsync
Operators
|wherecontainsor