Advanced Hunting To check when a process has been run

DeviceProcessEvents
| where FileName == "azuredatastudio.exe"
(No Ratings Yet)