EXE Search
Gives you a report from a specific date and onwards of a certain file name that was used within the tenant. (Replace "Outlook.exe" with the file name you are looking for, and replace date to desired range) Notes: LocalIP ≠ RemoteIP = Outbound connection
Microsoft Sentinel (KQL)
