Azure VM Run Command linked with MDE

'Identifies any Azure VM Run Command operations and links these operations with MDE host logging. Linking these two data sources provides hunting opportunities. Logging from AzureActivity provides the IP address and UPN of the account that invoked the command. Joining this with logging from MDE provides insights into what cmdlets were loaded by the command.'