let OfficeApps = dynamic(["winword.exe", "powerpnt.exe", "excel.exe", "outlook.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "regsvr32.exe"
| where InitiatingProcessFileName in~ (OfficeApps)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc