On Windows endpoints, find the registry enumeration activity that was used to locate password entries. What was the full command line executed?

DeviceRegistryEvents
| where RegistryKey contains 'password' or RegistryKey contains 'pwd' or RegistryValueName contains 'password' or RegistryValueName contains 'pwd' or RegistryValueData contains 'password' or RegistryValueData contains 'pwd'
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| order by Timestamp desc

// Lookup registry enumeration events for password-related entries
let RegEnumEvents = DeviceRegistryEvents
| where ActionType in ("RegEnumKey", "RegEnumValue", "RegQueryValue")
// Filter on keys or values containing “password” or the SAM hive
| where tolower(RegistryKey) contains "password"
     or tolower(RegistryValueName) contains "password"
     or RegistryKey startswith "HKEY_LOCAL_MACHINE\\SAM"
| extend CommandLine = InitiatingProcessCommandLine
| project TimeGenerated, DeviceName, InitiatingProcessFileName, CommandLine, ActionType, RegistryKey, RegistryValueName;

// Lookup use of ‘reg.exe’ to query password entries via command line
let RegExeEvents = DeviceProcessEvents
| where FileName == "reg.exe"
| where tolower(ProcessCommandLine) contains "query"
     and tolower(ProcessCommandLine) contains "password"
| extend CommandLine = ProcessCommandLine
| project TimeGenerated, DeviceName, InitiatingProcessFileName = FileName, CommandLine, ActionType = strcat("Process:", ActionType), RegistryKey = "(n/a)", RegistryValueName = "(n/a)";

// Union both sources and show latest
union RegEnumEvents, RegExeEvents
| sort by TimeGenerated desc