On a Windows host, an external PowerShell script is fetched and run to harvest local Wi-Fi credentials. Investigate the process execution logs to find out what script file name was downloaded and invoked.

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains ".ps1"
| project Timestamp, DeviceName, ProcessCommandLine

DeviceProcessEvents
| where FileName contains 'script'
| project FileName, ProcessId, DeviceName, TimeGenerated

DeviceProcessEvents
| where (InitiatingProcessFileName =~ 'powershell.exe' or InitiatingProcessFileName =~ 'pwsh.exe' or FileName =~ 'powershell.exe' or FileName =~ 'pwsh.exe')
| where ProcessCommandLine has_any ('Invoke-WebRequest', 'curl', 'wget', 'iwr', '-EncodedCommand', 'Start-BitsTransfer', '.ps1', 'http', 'https')
      or FileName endswith '.ps1'
| extend DownloadedScriptFile = extract(@'([\w\d-_]+\.ps1)', 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, DownloadedScriptFile
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "DownloadString", "wget", ".ps1")
| project DeviceName, ProcessCreationTime, ProcessId, FileName, ProcessCommandLine
| order by ProcessCreationTime desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ 'powershell.exe'
| where ProcessCommandLine contains 'Invoke-WebRequest' or ProcessCommandLine contains 'IEX' or ProcessCommandLine contains '.ps1'
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath
| join kind=leftouter (
    DeviceFileEvents
    | where ActionType == 'FileCreated' or ActionType == 'FileDownloaded'
    | where FileName endswith '.ps1'
    | project FileTimestamp=Timestamp, FileName, FileOriginUrl, FolderPath
) on FileName
| where isnull(FileTimestamp) or (FileTimestamp >= Timestamp - 1h and FileTimestamp <= Timestamp + 1h)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FileOriginUrl, FolderPath
| order by Timestamp desc

DeviceProcessEvents
| where FileName =~ 'powershell.exe'
| where ProcessCommandLine contains '.ps1' or ProcessCommandLine contains 'Invoke-WebRequest' or ProcessCommandLine contains 'bitsadmin'
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

union DeviceFileEvents, DeviceProcessEvents
| where ActionType in ("FileCreated", "FileDownloaded", "CreateProcess")
| where InitiatingProcessFileName has_any ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
// Look for .ps1 script references
| where FileName endswith ".ps1" or ProcessCommandLine has ".ps1" or FileOriginUrl has ".ps1"
| project TimeGenerated,
          DeviceName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          FileName,
          FolderPath,
          FileOriginUrl,
          ProcessCommandLine,
          ActionType,
          Type
| order by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Net.WebClient", "DownloadFile", "Invoke-WebRequest", "IEX")
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName contains "powershell.exe" and ProcessCommandLine contains ".ps1"
| extend FetchedScript = tostring(extract(@"\b(\S+\.ps1)\b", 1, ProcessCommandLine))
| where isnotempty(FetchedScript)
| project TimeGenerated, DeviceName, FileName, FetchedScript, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ProcessCommandLine has "PowerShell" and ProcessCommandLine contains ".ps1"
| extend ScriptName = extract(@'[\\/]+([^\\/\s]+\.ps1)', 1, ProcessCommandLine)
| where isnotempty(ScriptName)
| project TimeGenerated, DeviceName, ProcessCommandLine, ScriptName, InitiatingProcessFileName, FolderPath
| order by TimeGenerated desc
| take 100