PowerShell Encoded Command Execution (Living off the Land)

Original query, unchanged.

let Lookback = 1h;
let EncodedFlagRegex = @'(?i)(^|\s)-(encodedcommand|enc|ec|enco)\b';
let AllowlistedParents = dynamic([
  "SqlServer.exe", "ManagementStudio.exe", "devenv.exe",
  "ccmexec.exe", "SMSAgent.exe"
]);
let DownloadCradlePatterns = dynamic([
  "Net.WebClient", "WebRequest", "DownloadString", "DownloadFile",
  "IEX", "Invoke-Expression", "Invoke-RestMethod", "Start-BitsTransfer"
]);
let MDE_Results =
  DeviceProcessEvents
  | where Timestamp >= ago(Lookback)
  | where FileName in~ ("powershell.exe", "pwsh.exe")
  | where ProcessCommandLine matches regex EncodedFlagRegex
  | where not(InitiatingProcessFileName has_any (AllowlistedParents))
  | extend
      HasDownloadCradle = ProcessCommandLine has_any (DownloadCradlePatterns),
      AccountName       = InitiatingProcessAccountName,
      AccountDomain     = InitiatingProcessAccountDomain,
      HostName          = DeviceName,
      EventTime         = Timestamp
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
let SecEvent_Results =
  SecurityEvent
  | where TimeGenerated >= ago(Lookback)
  | where EventID == 4688
  | where NewProcessName endswith "\\powershell.exe"
      or NewProcessName endswith "\\pwsh.exe"
  | where CommandLine matches regex EncodedFlagRegex
  | where not(ParentProcessName has_any (AllowlistedParents))
  | extend
      HasDownloadCradle     = CommandLine has_any (DownloadCradlePatterns),
      AccountName           = SubjectUserName,
      AccountDomain         = SubjectDomainName,
      HostName              = Computer,
      EventTime             = TimeGenerated,
      ProcessCommandLine    = CommandLine,
      InitiatingProcessFileName = ParentProcessName
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(HasDownloadCradle, 2, 1)
| sort by RiskScore desc, EventTime desc