let VPN = SonicWallHunt_CL
| where event_ms >= 1793516400000 and event_ms < 1794072600000
| where h4_ready=="true"
| where kind=="vpn_success" and saml_enabled=="true" and expected_saml=="true" and auth_path=="alternate_verified"
| project session_key,rhs_vpn_ms=event_ms,rhs_vpn_principal=principal_id;
SonicWallHunt_CL
| where event_ms >= 1793516400000 and event_ms < 1794072600000
| extend process_name=tolower(process_name)
| where h4_ready=="true"
| where kind=="endpoint_admin_logon" or (kind=="endpoint_process" and process_name in ("powershell.exe","pwsh.exe","cmd.exe","wmic.exe","winrs.exe","mstsc.exe","psexec.exe"))
| where isnotempty(session_key) and session_key!="-"
| project session_key,event_ms,tenant_id,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id
| join kind=inner VPN on session_key
| where event_ms>=rhs_vpn_ms and event_ms<=rhs_vpn_ms+3600000
| project event_ms,tenant_id,session_key,rhs_vpn_ms,rhs_vpn_principal,principal_id,endpoint_id,kind,process_name,parent_name,command_line,record_id
