On a Windows endpoint, you find PowerShell reaching out to a remote URL and then running a module command. What was the LaZagne module name that was executed?

let secondsThreshold = 300;
// Network events where a PowerShell process made a remote connection
let networkPowershell = DeviceNetworkEvents
| where isnotempty(RemoteUrl) and tolower(InitiatingProcessFileName) has "powershell"
| project DeviceId, DeviceName, InitiatingProcessId, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, NetworkTime=TimeGenerated;

// Process events for PowerShell
let pwshProcesses = DeviceProcessEvents
| where tolower(FileName) has "powershell" or tolower(ProcessCommandLine) has "powershell"
| project DeviceId, ProcessTime=TimeGenerated, ProcessId, ProcessCommandLine;

// Join on DeviceId, then ensure the process ids match and timestamps are close
networkPowershell
| join kind=inner (pwshProcesses) on DeviceId
| where InitiatingProcessId == ProcessId and abs(datetime_diff("second", NetworkTime, ProcessTime)) <= secondsThreshold
// Extract LaZagne module name from either command line (case-insensitive)
| extend ModuleFromProc = extract(@"(?i)\b(lazagne[\w-]*)\b", 1, ProcessCommandLine)
| extend ModuleFromInit = extract(@"(?i)\b(lazagne[\w-]*)\b", 1, InitiatingProcessCommandLine)
| extend ModuleName = coalesce(ModuleFromProc, ModuleFromInit)
| where isnotempty(ModuleName)
| project DeviceName, Account=InitiatingProcessAccountName, RemoteUrl, ProcessId, ProcessTime, ProcessCommandLine, InitiatingProcessCommandLine, ModuleName
| distinct DeviceName, Account, RemoteUrl, ProcessId, ProcessTime, ModuleName, ProcessCommandLine, InitiatingProcessCommandLine
| order by ProcessTime desc