On a Windows host, investigate process events to find when Task Manager was launched via cmd with an unusual flag. What was the full command executed?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "taskmgr.exe"
| where InitiatingProcessFileName =~ "cmd.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents
| where FileName == 'Taskmgr.exe' and InitiatingProcessFileName == 'cmd.exe'
| where ProcessCommandLine !contains '/s'
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine

DeviceProcessEvents
| where FileName =~ "taskmgr.exe"
| where InitiatingProcessFileName =~ "cmd.exe"
| where ProcessCommandLine has_any("/", "-") and not(ProcessCommandLine has_any("/1", "/2", "/3", "/4", "/5", "/6"))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFileName

DeviceProcessEvents
| where InitiatingProcessCommandLine has_any ("cmd.exe", "/") 
| where ProcessCommandLine contains "taskmgr"
| extend weird_flag = iff(ProcessCommandLine has "@echo off", "false", "true")
| summarize by AccountName, AccountSid, DeviceId, DeviceName, InitCmd = InitiatingProcessCommandLine, Cmd = ProcessCommandLine, weird_flag
| order by Cmd asc nulls last

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "taskmgr.exe" or ProcessCommandLine has_cs "taskmgr"
| where InitiatingProcessFileName =~ "cmd.exe"
// Require a switch after taskmgr (unusual because Task Manager is typically launched without flags)
| where ProcessCommandLine matches regex @"(?i)\btaskmgr(?:\.exe)?\b.*(?:^|\s)[-/][^\s\""]+"
// Extract one or more flags used with taskmgr
| extend Flags = extract_all(@"(?i)(?:^|\s)([-/][\w\.-]+)", ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FullCommand=ProcessCommandLine, Flags
| order by TimeGenerated asc

let suspiciousRegex = @"(?i)\/(e\b|s\b|q\b|off\b|k\b|c\b)";
union DeviceProcessEvents, DeviceEvents
| where tolower(InitiatingProcessFileName) has "cmd"
  and (tolower(FileName) == "taskmgr.exe" or tolower(ProcessCommandLine) has "taskmgr")
| extend InitiatingCommand = tostring(InitiatingProcessCommandLine), TargetCmd = tostring(ProcessCommandLine)
| extend SuspiciousFlagFound = (InitiatingCommand matches regex suspiciousRegex) or (TargetCmd matches regex suspiciousRegex)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingCommand, FileName, TargetCmd, ProcessId, InitiatingProcessId, SuspiciousFlagFound
| sort by SuspiciousFlagFound desc, TimeGenerated desc
| limit 100

DeviceProcessEvents
| where FileName has_cs "taskmgr" or ProcessCommandLine has_cs "taskmgr"
| where InitiatingProcessFileName has_cs "cmd" or InitiatingProcessCommandLine has_cs "cmd"
| extend InitiatorCmdLine = tostring(InitiatingProcessCommandLine), TargetCmdLine = tostring(ProcessCommandLine)
// flag detection: look for typical slash/dash flags in the taskmgr command line or common cmd execution switches
| extend TargetHasFlag = iff(TargetCmdLine matches regex @"\s/[^ \t]+" or TargetCmdLine matches regex @"\s-[^\s]+", 1, 0)
| where TargetHasFlag == 1 or InitiatorCmdLine contains "/c" or InitiatorCmdLine contains "/k"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessId, InitiatorCmdLine, FileName, ProcessId, TargetCmdLine, InitiatingProcessCreationTime, ProcessCreationTime
| order by TimeGenerated desc
| take 200

// Find Task Manager (taskmgr.exe) launched where initiating process is cmd.exe (or contains cmd)
// Use DeviceProcessEvents primarily, fall back to DeviceEvents

let process_table = DeviceProcessEvents;
let event_table = DeviceEvents;

process_table
| where true
// Filter to Task Manager processes by filename or commandline
| where (tolower(FileName) has "taskmgr" ) or (tolower(ProcessCommandLine) has "taskmgr")
// Ensure initiating process exists and is cmd
| where (tolower(InitiatingProcessFileName) has "cmd") or (tolower(InitiatingProcessCommandLine) has "cmd") or (tolower(InitiatingProcessFileName) has "c:\\windows\\system32\\cmd.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessId
| sort by TimeGenerated desc
| take 100

// Also check DeviceEvents for similar entries
| union (
    event_table
    | where true
    | where (tolower(FileName) has "taskmgr") or (tolower(ProcessCommandLine) has "taskmgr") or (tolower(ProcessCommandLine) has "taskmgr.exe")
    | where (tolower(InitiatingProcessFileName) has "cmd") or (tolower(InitiatingProcessCommandLine) has "cmd")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId=InitiatingProcessId, InitiatingProcessAccountName, FileName, ProcessCommandLine, ProcessId=ProcessId
    | sort by TimeGenerated desc
    | take 100
)
| sort by TimeGenerated desc
| top 50 by TimeGenerated

DeviceProcessEvents
| where tolower(FileName) contains "taskmgr.exe" or tolower(ProcessCommandLine) contains "taskmgr.exe"
| where tolower(InitiatingProcessFileName) contains "cmd.exe" or tolower(InitiatingProcessCommandLine) contains "cmd"
| where ProcessCommandLine contains "/" // presence of a slash-delimited flag indicates an unusual flag
| project TimeGenerated, DeviceName, DeviceId, ProcessId, InitiatingProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, InitiatingProcessFolderPath, InitiatingProcessSessionId
| extend FullCommandExecuted = strcat(coalesce(InitiatingProcessCommandLine, ""), " ", coalesce(ProcessCommandLine, ""))
| sort by TimeGenerated desc

let TimeRange = 7d;
DeviceProcessEvents
| where TimeGenerated >= ago(TimeRange)
| where InitiatingProcessFileName == "cmd.exe"
| where tolower(InitiatingProcessCommandLine) contains "taskmgr"
| extend FullCommand = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, FullCommand, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessId, InitiatingProcessSessionId
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ 'taskmgr.exe'
| where InitiatingProcessFileName =~ 'cmd.exe'
| where ProcessCommandLine contains ' '
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where InitiatingProcessFileName =~ "cmd.exe"
| where FileName =~ "taskmgr.exe"
| where ProcessCommandLine has "/"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by TimeGenerated desc

// Investigate instances where Task Manager (taskmgr.exe) was launched *from* a cmd.exe shell 
// and received at least one command-line argument (i.e. an “unusual” flag).
// The query returns the full command that was executed together with basic context.
// (Timerange is supplied when the function is invoked)
DeviceProcessEvents
| where FileName =~ "taskmgr.exe"                               // child process
| where InitiatingProcessFileName =~ "cmd.exe"                  // launched from cmd.exe
| where isnotempty(ProcessCommandLine)                           // we have a command line
| where not(ProcessCommandLine matches regex @"(?i)^\s*taskmgr\.exe\s*$") // command line contains something more than just the executable name
| extend UnusualFlag = trim("\"", tostring(extract(@"taskmgr\.exe\s+(.*)$",1,ProcessCommandLine)))
| project TimeGenerated,
          DeviceName,
          DeviceId,
          Account = strcat(InitiatingProcessAccountDomain, "\\", InitiatingProcessAccountName),
          TaskmgrCommand = ProcessCommandLine,
          ParentCmdLine  = InitiatingProcessCommandLine,
          UnusualFlag
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "taskmgr.exe"
| where InitiatingProcessFileName =~ "cmd.exe"
// Optionally, if you know part of the unusual flag pattern, you can add a further filter like:
// | where InitiatingProcessCommandLine contains "-unusualFlag" 
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessId
| sort by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where tolower(FileName) endswith "cmd.exe"
| where tolower(ProcessCommandLine) has "taskmgr.exe"
| project TimeGenerated, DeviceName, ProcessCommandLine