SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE ("Process Name" ILIKE 'powershell.exe' OR "Process Name" ILIKE 'pwsh.exe') AND ("Process CommandLine" ILIKE '%.downloadstring(%' OR "Process CommandLine" ILIKE '%.downloadfile(%' OR "Process CommandLine" ILIKE '%.downloaddata(%') AND ("Process CommandLine" ILIKE '%iex%' OR "Process CommandLine" ILIKE '%invoke-expression%')
LAST 7 DAYS