On a Windows system, security logs show a PowerShell process downloaded and executed a WinPwn script. Which function name was invoked to perform the search for credentials or other sensitive data?

DeviceProcessEvents
| where FileName has "powershell"
| where ProcessCommandLine has "WinPwn"
| extend potentialFunctionName = extract(@'WinPwn.*?(\b[a-zA-Z-]+\b)', 1, ProcessCommandLine)
| where isnotempty(potentialFunctionName)
| project Timestamp, DeviceName, ProcessCommandLine, potentialFunctionName

DeviceProcessEvents
| where InitiatingProcessFileName contains "powershell" and InitiatingProcessCommandLine contains "WinPwn"
| project InitiatingProcessId, ProcessCommandLine, InitiatingProcessCommandLine

DeviceProcessEvents
| where InitiatingProcessFileName contains "powershell.exe"
| where ProcessCommandLine contains "winpwn" or ProcessCommandLine contains "credential" or ProcessCommandLine contains "password" or ProcessCommandLine contains "sensitive" or ProcessCommandLine contains "dump"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FileName, FolderPath
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "WinPwn"
| parse kind=regex ProcessCommandLine with @"(Invoke-[^\s]+)" FunctionName
| project TimeGenerated, DeviceName, FunctionName, ProcessCommandLine

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has "WinPwn"
| parse kind=regex flags=U ProcessCommandLine with @".*(Invoke-[^\s]+).*" FunctionName
| project TimeGenerated, DeviceName, ProcessCommandLine, FunctionName
| order by TimeGenerated desc