On a Windows system, someone ran PowerShell to copy a file from a remote machine’s C$ share to the local TEMP folder. Using process event logs, what full PowerShell command was executed to perform this action?

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine contains "\\"
| where ProcessCommandLine contains "TEMP"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

DeviceProcessEvents
| where InitiatingProcessFileName == 'powershell.exe'
| where ProcessCommandLine has 'copy' or ProcessCommandLine has 'cp'
| where ProcessCommandLine has '\\c$' and ProcessCommandLine has 'TEMP'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, ProcessCommandLine
| sort by TimeGenerated desc

DeviceProcessEvents
| where tolower(FileName) in ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "C$" and ProcessCommandLine has "\\" and ProcessCommandLine has "$"
| where ProcessCommandLine contains "temp" or ProcessCommandLine contains "%temp%" or ProcessCommandLine contains "appdata\\local\\temp"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
| sort by TimeGenerated desc

let tempPath = "\\TEMP\\";
let cshare = "$";
DeviceProcessEvents
| where ProcessCommandLine has tempPath and ProcessCommandLine has cshare
| summarize count(), make_list(ProcessCommandLine)
| order by count_ desc
| extend Full_PowerShell_Command = list_ProcessCommandLine[0]
|  project-away count_, list_ProcessCommandLine

DeviceProcessEvents
| where tolower(FileName) == "powershell.exe"
| where ProcessCommandLine has "\\" and ProcessCommandLine has "C$"
| where tolower(ProcessCommandLine) contains "temp"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| order by TimeGenerated desc
| limit 10

DeviceProcessEvents | where FileName has_any ('powershell', 'PowerShell') | where ProcessCommandLine contains 'copy' or ProcessCommandLine contains 'xcopy' | where ProcessCommandLine contains 'C$' and ProcessCommandLine contains 'TEMP' | project TimeGenerated, DeviceName, ProcessCommandLine | order by TimeGenerated desc

DeviceProcessEvents
| where FileName contains "powershell" and ProcessCommandLine contains "copy" and ProcessCommandLine contains "C$" and ProcessCommandLine contains "TEMP"
| project ProcessCommandLine

DeviceProcessEvents
| where ActionType == 'ProcessCreated'
| where FileName in~ ('powershell.exe','pwsh.exe','powershell_ise.exe')
// Remote admin share (\\host\c$\...)
| where ProcessCommandLine contains '\\c$\\'
// Copy via PowerShell (Copy-Item or common aliases)
| where ProcessCommandLine has_any ('copy','cp','cpi','robocopy')
// Destination mentions a TEMP location/variable
| where ProcessCommandLine contains '$env:TEMP' or ProcessCommandLine contains '$env:TMP' or
        ProcessCommandLine contains '%TEMP%' or ProcessCommandLine contains '%TMP%' or
        ProcessCommandLine contains '\\AppData\\Local\\Temp' or ProcessCommandLine contains '\\Windows\\Temp' or
        ProcessCommandLine contains ':\\Temp' or ProcessCommandLine contains '\\Temp\\'
| project TimeGenerated, DeviceName, AccountDomain, AccountName, PowerShellCommand=ProcessCommandLine
| order by TimeGenerated desc

let srcRegex = @"(?i)\\\\[^\\]+\\C\$\\";  
let destRegex = @"(?i)(%temp%|\$env:TEMP|\\Temp\\|\\Users\\[^\\]+\\AppData\\Local\\Temp\\)";  
union DeviceProcessEvents, DeviceEvents  
| extend Cmd = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)  
| where isnotempty(Cmd)  
| where (FileName has "powershell" or Cmd has "powershell" or Cmd has "pwsh")  
| where Cmd matches regex srcRegex and Cmd matches regex destRegex  
| project TimeGenerated = coalesce(Timestamp, TimeGenerated), DeviceName, Account = coalesce(InitiatingProcessAccountName, AccountName), ProcessFileName = FileName, ProcessId, CommandLine = Cmd  
| order by TimeGenerated desc

DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| where tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh"
| where tolower(ProcessCommandLine) contains "copy-item"
| where tolower(ProcessCommandLine) contains "c$"
| project TimeGenerated, DeviceName, AccountDomain, AccountName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, ProcessCommandLine

DeviceProcessEvents
| where FileName contains "powershell.exe"
| where ProcessCommandLine contains "C$" and ProcessCommandLine contains "temp"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| order by Timestamp desc

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Copy-Item", "copy")
| where ProcessCommandLine has "C$" and ProcessCommandLine has "temp"
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where ActionType =~ "ProcessCreated"
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has "C$" and ProcessCommandLine has "temp" and ProcessCommandLine has_any ("copy", "cp", "xcopy")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine, FolderPath, FileName, SHA256, InitiatingProcessCommandLine
| order by TimeGenerated desc

// PowerShell file-copy from a remote C$ share to the local TEMP folder
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName has_cs "powershell"             // powershell.exe, pwsh.exe, etc.
// must reference a remote administrative C$ share
| where ProcessCommandLine contains "\\" and ProcessCommandLine contains "\\c$"
// indication of a copy operation
| where ProcessCommandLine has_any ("copy-item", "Copy-Item", " copy ", "copy ")
// destination is some form of the local temporary directory
| where ProcessCommandLine has_any ("%temp%", "\\temp\\", "\\Temp\\", "windows\\temp", "$env:TEMP", "$env:temp")
// ————————————————————————————————————————
| project TimeGenerated,
          DeviceName,
          AccountDomain,
          AccountName,
          FileName,
          ProcessCommandLine
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Copy-Item"
      and ProcessCommandLine contains "\\C$"
      and ProcessCommandLine contains "Temp"
| project Timestamp, DeviceName, InitiatingProcessAccountName, ProcessCommandLine
| sort by Timestamp desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
// Only look at PowerShell processes
| where FileName has "powershell" or ProcessCommandLine has "powershell"
// Filter for UNC path pointing to a C$ share and local TEMP folder
| where ProcessCommandLine has "\\" 
| where tolower(ProcessCommandLine) has "c$"
| where tolower(ProcessCommandLine) has "temp"
// Select relevant fields
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
// Order by most recent
| order by TimeGenerated desc