Detect Lateral Tool Transfer in Microsoft Sentinel

let ExecutableExtensions = dynamic([".exe", ".dll", ".ps1", ".bat", ".cmd", ".vbs", ".hta", ".js", ".msi", ".scr", ".cpl"]);
let LOLBins = dynamic(["certutil.exe", "bitsadmin.exe", "esentutl.exe", "robocopy.exe", "expand.exe", "makecab.exe"]);
let TransferTools = dynamic(["psexec.exe", "psexec64.exe", "paexec.exe", "scp.exe", "sftp.exe", "ftp.exe", "winscp.exe"]);
let SensitiveDirs = dynamic(["\\Windows\\Temp\\", "\\Windows\\System32\\", "\\Windows\\SysWOW64\\", "\\ProgramData\\", "\\Users\\Public\\"]);
// Branch A: LOLBins executing lateral file transfers
let LOLBinTransfers = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (LOLBins)
| where ProcessCommandLine has @"\\\\"
    or (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("urlcache", "-f", "-split"))
    or (FileName =~ "bitsadmin.exe" and ProcessCommandLine has_any ("/transfer", "/addfile", "/upload"))
    or (FileName =~ "esentutl.exe" and ProcessCommandLine has_any ("/cp", "/y"))
    or (FileName =~ "robocopy.exe" and ProcessCommandLine matches regex @"\\\\[A-Za-z0-9\-\.]+\\")
| extend IsCertutil = FileName =~ "certutil.exe"
| extend IsBitsadmin = FileName =~ "bitsadmin.exe"
| extend IsEsentutl = FileName =~ "esentutl.exe"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsCertutil, IsBitsadmin, IsEsentutl, DetectionBranch="LOLBin_Transfer";
// Branch B: Transfer tools referencing internal hosts or UNC paths
let ToolTransfers = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (TransferTools)
| where ProcessCommandLine has @"\\\\"
    or ProcessCommandLine matches regex @"(?:^|[\s\t@:])(?:10\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch="Transfer_Tool";
// Branch C: Executables dropped via SMB (System process writing executables to sensitive directories)
let SMBExecutableDrops = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileName has_any (ExecutableExtensions)
| where FolderPath has_any (SensitiveDirs)
| where InitiatingProcessFileName =~ "System"
| project Timestamp, DeviceName,
         AccountName=InitiatingProcessAccountName,
         FileName, FolderPath, SHA256,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch="SMB_Executable_Drop";
// Union all branches
LOLBinTransfers
| union ToolTransfers
| union SMBExecutableDrops
| sort by Timestamp desc