PowershellCommand footprint

id: 261d966b-5c1a-4d28-b444-3a8caac6246e
name: PowershellCommand footprint
description: |
  Find all machines running a given Powersehll cmdlet.
  This covers all Powershell commands executed in the Powershell engine by any process.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  let powershellCommandName = "Invoke-RickAscii";
  DeviceEvents
  | where ActionType == "PowerShellCommand"
  // This filter improves query performance, as it avoids needing to parse Command from all rows and only then applying a filter
  | where AdditionalFields contains powershellCommandName
  // Extract the powershell command name from the Command field in the AdditionalFields JSON column
  | project PowershellCommand=extractjson("$.Command", AdditionalFields, typeof(string)), InitiatingProcessCommandLine, InitiatingProcessParentFileName, Timestamp, DeviceId
  // Do an exact case-insensitive match on the command name field
  | where PowershellCommand =~ powershellCommandName