DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any (".js", ".jse")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| sort by Timestamp desc