All Detections

PowershellCommand footprint

Azure Sentinel@AzureSentinel
updated Jun 17, 2025021

Find all machines running a given Powersehll cmdlet. This covers all Powershell commands executed in the Powershell engine by any process.

Microsoft Sentinel (KQL)