Detect Remote Desktop Software in Microsoft Sentinel

let RMMTools = dynamic([
  "teamviewer.exe", "teamviewer_service.exe", "tv_w32.exe", "tv_x64.exe",
  "anydesk.exe", "anydesk_service.exe",
  "screenconnect.exe", "screenconnectclient.exe", "connectwisecontrol.client.exe",
  "logmein.exe", "lmi_rescue.exe", "logmeinrescue.exe", "logmeinrescueworkstation.exe",
  "ammyyadmin.exe", "aa_v3.exe",
  "vnc.exe", "vncviewer.exe", "tvnserver.exe", "winvnc.exe", "uvnc_service.exe", "vncserver.exe",
  "splashtop.exe", "splashtopremote.exe", "splashtop_streamer.exe",
  "rustdesk.exe", "supremo.exe", "supremoservice.exe",
  "netsupportmanager.exe", "client32.exe",
  "chrome_remote_desktop.exe", "remoting_host.exe",
  "zoommtg.exe"
]);
let SuspiciousParents = dynamic([
  "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe",
  "cscript.exe", "mshta.exe", "rundll32.exe", "msiexec.exe",
  "taskeng.exe", "taskhostw.exe"
]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (RMMTools)
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend FromTempPath = FolderPath has_any ("\\Temp\\", "\\tmp\\", "\\AppData\\Local\\Temp", "\\Downloads\\")
| extend IsPortable = FolderPath !startswith "C:\\Program Files" and FolderPath !startswith "C:\\Program Files (x86)"
| extend ToolFamily = case(
    FileName has_any ("teamviewer", "tv_w32", "tv_x64"), "TeamViewer",
    FileName has_any ("anydesk"), "AnyDesk",
    FileName has_any ("screenconnect", "connectwise"), "ScreenConnect",
    FileName has_any ("logmein", "lmi_rescue"), "LogMeIn",
    FileName has_any ("ammyy", "aa_v3"), "AmmyyAdmin",
    FileName has_any ("vnc", "tvnserver", "winvnc", "uvnc"), "VNC",
    FileName has_any ("splashtop"), "Splashtop",
    FileName has_any ("rustdesk"), "RustDesk",
    FileName has_any ("supremo"), "Supremo",
    FileName has_any ("netsupport", "client32"), "NetSupport",
    FileName has_any ("chrome_remote", "remoting_host"), "ChromeRD",
    "Other")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ToolFamily, SuspiciousParent, FromTempPath, IsPortable
| sort by Timestamp desc