On Windows hosts, look through recent PowerShell execution records to find any elevated session where remote management was turned on. What exact command was run to enable PSRemoting?

DeviceProcessEvents
| where ProcessCommandLine contains 'Enable-PSRemoting -Force'

DeviceProcessEvents 
| where ProcessCommandLine has_all ("powershell", "enable-psremoting")
| project Timestamp, ProcessCommandLine, DeviceName, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessParentFileName
| order by Timestamp desc

DeviceProcessEvents
| where FileName endswith "powershell.exe"
      and ProcessTokenElevation != "" 
      and ProcessTokenElevation !in ("Default")
      and (isnotempty(IsInitiatingProcessRemoteSession) or isnotempty(IsProcessRemoteSession))
| where ProcessCommandLine contains "Enable-PSRemoting" or ProcessCommandLine contains "winrm quickconfig" or ProcessCommandLine contains "Set-WSManQuickConfig"
| project DeviceName, InitiatingProcessAccountName, ProcessCommandLine, TimeGenerated

union isfuzzy=true DeviceProcessEvents, DeviceEvents
| where (tolower(FileName) contains "powershell" or tolower(FileName) contains "pwsh" or tolower(ProcessCommandLine) contains "powershell" or tolower(ProcessCommandLine) contains "pwsh")
// Look for common PSRemoting enabling commands
| where (
    tolower(ProcessCommandLine) contains "enable-psremoting" 
    or tolower(ProcessCommandLine) contains "winrm quickconfig"
    or tolower(ProcessCommandLine) contains "set-item wsman"
    or tolower(ProcessCommandLine) contains "enable-wsmancredssp"
    or tolower(ProcessCommandLine) contains "enable-pssessionconfiguration"
)
// Restrict to elevated sessions (token elevation or high integrity)
| where (
    tolower(ProcessTokenElevation) contains "elev" 
    or tolower(InitiatingProcessTokenElevation) contains "elev"
    or tolower(ProcessIntegrityLevel) contains "high"
    or tolower(InitiatingProcessIntegrityLevel) contains "high"
)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, ProcessId, InitiatingProcessId, ProcessCommandLine, InitiatingProcessCommandLine, ProcessTokenElevation, InitiatingProcessTokenElevation, ReportId, _ResourceId
| sort by TimeGenerated desc
| take 100

// Find PowerShell executions that enabled PSRemoting or related WSMan settings
let RemotingPatterns = dynamic(["Enable-PSRemoting","Enable-WSManCredSSP","Enable-PsRemoting","winrm quickconfig","winrm qc","Set-Item -Path WSMan:","Set-WSManQuickConfig","Enable-WSMan","Configure-SMRemoting"]);
let pwshNames = dynamic(["powershell.exe","pwsh.exe","powershell_ise.exe"]);

// DeviceProcessEvents: has elevation fields
let dpe = DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) or FileName has_any(pwshNames)
| where ProcessCommandLine has_any(RemotingPatterns) or InitiatingProcessCommandLine has_any(RemotingPatterns) or FileName has_any(pwshNames)
| extend FullCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| project TimeGenerated, SourceTable = "DeviceProcessEvents", DeviceName, DeviceId, AccountDomain, AccountName, FullCommandLine, InitiatingCommandLine = InitiatingProcessCommandLine, InitiatingFile = InitiatingProcessFileName, ProcessTokenElevation, InitiatingProcessTokenElevation, InitiatingSession = InitiatingProcessSessionId, ReportId, FileName
| extend ElevationConcat = tolower(coalesce(ProcessTokenElevation, InitiatingProcessTokenElevation, ""))
| extend IsElevated = case(ElevationConcat contains "high" or ElevationConcat contains "elevat" or ElevationConcat contains "%%16895", "Yes", ElevationConcat == "" or ElevationConcat == "unknown", "Unknown", "No");

// DeviceEvents: may not have token elevation reliably
let de = DeviceEvents
| where TimeGenerated >= ago(30d)
| where isnotempty(ProcessCommandLine) or isnotempty(InitiatingProcessCommandLine) or FileName has_any(pwshNames)
| where ProcessCommandLine has_any(RemotingPatterns) or InitiatingProcessCommandLine has_any(RemotingPatterns) or FileName has_any(pwshNames)
| extend FullCommandLine = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| project TimeGenerated, SourceTable = "DeviceEvents", DeviceName, DeviceId, AccountDomain, AccountName, FullCommandLine, InitiatingCommandLine = InitiatingProcessCommandLine, InitiatingFile = InitiatingProcessFileName, InitiatingSession = InitiatingProcessSessionId, ReportId, FileName
| extend IsElevated = "Unknown";

union dpe, de
| extend DetectedCommand = extract(@"(?i)((Enable-PSRemoting|Enable-WSManCredSSP|Enable-PsRemoting|winrm\s+quickconfig|winrm\s+qc|Set-Item\s+-Path\s+WSMan:|Set-WSManQuickConfig|Enable-WSMan)[^\r\n;]{0,400})", 1, FullCommandLine)
| where isnotempty(DetectedCommand)
| where IsElevated == "Yes" or IsElevated == "Unknown"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Count = count(), AnyAccount = any(AccountName), AnyInitiatingFile = any(InitiatingFile), AnyInitiatingSession = any(InitiatingSession), AnyFileName = any(FileName), AnyReportId = any(ReportId) by DeviceId, DeviceName, IsElevated, DetectedCommand, FullCommandLine, SourceTable
| order by LastSeen desc
| project FirstSeen, LastSeen, Count, DeviceName, DeviceId, IsElevated, DetectedCommand, FullCommandLine, SourceTable, AnyAccount, AnyInitiatingFile, AnyInitiatingSession, AnyFileName, AnyReportId