dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) in ("powershell.exe", "pwsh.exe") and (lowercase(action_process_image_command_line) contains ".downloadstring(" or lowercase(action_process_image_command_line) contains ".downloadfile(" or lowercase(action_process_image_command_line) contains ".downloaddata(") and (lowercase(action_process_image_command_line) contains "iex" or lowercase(action_process_image_command_line) contains "invoke-expression")
| fields _time, agent_hostname, actor_effective_username, action_process_image_name, action_process_image_command_line, actor_process_image_name, causality_actor_process_image_name
| sort desc _time