Question Analysis

let PowerShellProfilePaths = dynamic(['Microsoft.PowerShell_profile.ps1', 'profile.ps1']); DeviceFileEvents | where FolderPath has 'Users' and FileName in (PowerShellProfilePaths) | where ActionType in ('FileModified', 'FileCreated', 'FileWritten') | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, ActionType, CommandLine = InitiatingProcessCommandLine | union ( DeviceProcessEvents | where ProcessCommandLine has 'powershell' or ProcessCommandLine has 'pwsh' | where ProcessCommandLine has 'profile.ps1' or ProcessCommandLine has 'Microsoft.PowerShell_profile.ps1' or ProcessCommandLine has 'start' or ProcessCommandLine has 'cmd' | project Timestamp, DeviceName, AccountName, FileName = InitiatingProcessFileName, FolderPath = InitiatingProcessFolderPath, ActionType = 'ProcessLaunch', CommandLine = ProcessCommandLine ) | union ( DeviceRegistryEvents | where RegistryKey has 'PowerShell' or RegistryValueData has 'profile.ps1' | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = '', FolderPath = RegistryKey, ActionType = 'RegistryModification', CommandLine = InitiatingProcessCommandLine ) | order by Timestamp desc