DeviceProcessEvents
| where Timestamp > ago(1d)
| where (FileName =~ "pktmon.exe")
or (FileName =~ "netsh.exe" and ProcessCommandLine has "trace")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc