Trusted Developer Utilities Proxy Execution

// set timeframe
let Timeframe = 30d;
DeviceProcessEvents
| where Timestamp > ago(Timeframe)
| where (FileName has_any ("msbuild.exe", "msxsl.exe")
or (FileName has_any ("vbc.exe","csc.exe","jsc.exe") and ProcessCommandLine has_any ("/exe","/dll","/pe64","-exe","-dll","-pe64"))
or (FileName == ("ilsasm.exe") and ProcessCommandLine has_any ("out","target","t:","reference","r:")))
// Filter initations by Visual Studio since this is expected behavior
  and not(FolderPath startswith "C:\\Program Files (x86)\\Microsoft Visual Studio" 
  or InitiatingProcessFolderPath startswith "C:\\Program Files (x86)\\Microsoft Visual Studio" 
  and (InitiatingProcessFileName == "devenv.exe" or InitiatingProcessFileName == "WDExpress.exe"))