On a Windows endpoint, review any events showing content being appended to a user’s PowerShell profile that introduce new process launches. What exact command line was added?

let PowerShellProfilePaths = dynamic(['Microsoft.PowerShell_profile.ps1', 'profile.ps1']);
DeviceFileEvents
| where FolderPath has 'Users' and FileName in (PowerShellProfilePaths)
| where ActionType in ('FileModified', 'FileCreated', 'FileWritten')
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, ActionType, CommandLine = InitiatingProcessCommandLine
| union (
    DeviceProcessEvents
    | where ProcessCommandLine has 'powershell' or ProcessCommandLine has 'pwsh'
    | where ProcessCommandLine has 'profile.ps1' or ProcessCommandLine has 'Microsoft.PowerShell_profile.ps1' or ProcessCommandLine has 'start' or ProcessCommandLine has 'cmd'
    | project Timestamp, DeviceName, AccountName, FileName = InitiatingProcessFileName, FolderPath = InitiatingProcessFolderPath, ActionType = 'ProcessLaunch', CommandLine = ProcessCommandLine
)
| union (
    DeviceRegistryEvents
    | where RegistryKey has 'PowerShell' or RegistryValueData has 'profile.ps1'
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = '', FolderPath = RegistryKey, ActionType = 'RegistryModification', CommandLine = InitiatingProcessCommandLine
)
| order by Timestamp desc