Outbound RDP Connections

DeviceNetworkEvents 
| where ((RemotePort == "3389" and RemotePort == 'true') 
and ((InitiatingProcessCommandLine !endswith @'\mstsc.exe' 
or InitiatingProcessCommandLine !endswith @'\RTSApp.exe' 
or InitiatingProcessCommandLine !endswith @'\RTS2App.exe' 
or InitiatingProcessCommandLine !endswith @'\RDCMan.exe' 
or InitiatingProcessCommandLine !endswith @'\ws_TunnelService.exe' 
or InitiatingProcessCommandLine !endswith @'\RSSensor.exe' 
or InitiatingProcessCommandLine !endswith @'\RemoteDesktopManagerFree.exe' 
or InitiatingProcessCommandLine !endswith @'\RemoteDesktopManager.exe' 
or InitiatingProcessCommandLine !endswith @'\RemoteDesktopManager64.exe' 
or InitiatingProcessCommandLine !endswith @'\mRemoteNG.exe' 
or InitiatingProcessCommandLine !endswith @'\mRemote.exe' 
or InitiatingProcessCommandLine !endswith @'\Terminals.exe' 
or InitiatingProcessCommandLine !endswith @'\spiceworks-finder.exe' 
or InitiatingProcessCommandLine !endswith @'\FSDiscovery.exe' 
or InitiatingProcessCommandLine !endswith @'\FSAssessment.exe' 
or InitiatingProcessCommandLine !endswith @'\MobaRTE.exe' 
or InitiatingProcessCommandLine !endswith @'\chrome.exe' 
or InitiatingProcessCommandLine !endswith @'\thor.exe' 
or InitiatingProcessCommandLine !endswith @'\thor64.exe')))