KQL-MTP-Detection-Remote-Session

// How long to lookback
let lookBack_long = 30d;
// Timeframe for the series
let TimeFrame = 3h;
// Anomaly threshold
let AnomalyThreshold = 3;
// Distinct Device Threshold
let DeviceThreshold = 4;
DeviceLogonEvents
// Look for all events with the type Remote Interactive
| where LogonType in ("RemoteInteractive")
// Make a series based on Distinct devices by User Accounts
| make-series DistinctDeviceCount = dcount(DeviceId), ReportId = max(ReportId) on Timestamp in range(startofday(ago(lookBack_long)),now(), TimeFrame) by AccountName, AccountSid
// Do anomaly detection on DistinctDeviceCount 
| extend (AnomaliesDetected, AnomaliesScore, AnomaliesBaseline) = series_decompose_anomalies(DistinctDeviceCount, AnomalyThreshold, -1, 'linefit')
// Place all the items on a single line
| mv-expand DistinctDeviceCount to typeof(double), Timestamp to typeof(datetime), ReportId to typeof(double), AnomaliesDetected to typeof(double), AnomaliesScore to typeof(double), AnomaliesBaseline to typeof(long)
// Show all rows with a detected anomaly and where the threshold is higher than DeviceThreshold
| where AnomaliesDetected == 1 and SignIns >= DeviceThreshold
// Only show alerts in the TimeFrame
| where Timestamp >= ago(TimeFrame)

Read my blog for more information about this query Remote Session Anomaly Detection