Hidden in Plain Sight: PowerShell Visibility Most Defender XDR Analysts Miss

This blog explains how to improve PowerShell visibility in Microsoft Defender XDR by querying DeviceEvents for PowerShellCommand telemetry to reveal commands executed inside .ps1 scripts; it provides sample KQL queries and hunting indicators (download functions, IEX/EncodedCommand, credential-dumping references, memory-injection APIs) to help investigators and threat hunters detect suspicious PowerShell activity when the script file is not available.