KQL Search

# Function: LastPowerShellExecutions ()

## Query Information

#### Description
This function returns the last x amount of powershell executions that have been executed from a specified device. The function takes a *DeviceName* as input for which device the last executions need to be returned. The *Results* determines how many resuls are returned. Lastly the *TimeFrame* variable decides what the lookback period is. 

#### References
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/functions/user-defined-functions
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-custom-functions?view=o365-worldwide
- https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/timespan

## Defender For Endpoint
```
// Returns the last x amount of powershell executions based on a device and the timespan. Timespan examples can be seen in https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/timespan
let LastPowerShellExecutions = (DeviceNameInput: string, Results: int, TimeFrame: timespan) {
    DeviceProcessEvents
    | where Timestamp > ago(TimeFrame)
    | where DeviceName =~ DeviceNameInput
    // Function does by default filter system executions, if you want them included exclude the line below.
    | where not(AccountSid == "S-1-5-18")
    | where ProcessCommandLine contains "powershell"
    | top Results by Timestamp
    | project Timestamp, ActionType, ProcessCommandLine
};
// Example
LastPowerShellExecutions("devicename.tld", 100, 1d)
```
## Sentinel
```
// Returns the last x amount of powershell executions based on a device and the timespan. Timespan examples can be seen in https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/scalar-data-types/timespan
let LastPowerShellExecutions = (DeviceNameInput: string, Results: int, TimeFrame: timespan) {
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeFrame)
    | where DeviceName =~ DeviceNameInput
    // Function does by default filter system executions, if you want them included exclude the line below.
    | where not(AccountSid == "S-1-5-18")
    | where ProcessCommandLine contains "powershell"
    | top Results by TimeGenerated
    | project TimeGenerated, ActionType, ProcessCommandLine
};
// Example
LastPowerShellExecutions("devicename.tld", 100, 1d)
```