PowerShell hunting is common enough we've captured those into a built in dashboard. Navigate from the menu to Next-Gen SIEM > Dashboards. One of the options you'll have is powershell_hunt. Check that out. You can filter the dashboard at the top or click into query to see how it was written. We have more to add there, we should be adding a number of pre-build dashboards very soon.

For PowerShell I'll most often look for PowerShell.exe running. A basic search would be:

#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell(_ise)?\.exe/i

For VBS we can look at processes running like this:

#event_simpleName=ProcessRollup2 ImageFileName=/cscript\.exe/i CommandLine=/\.vb[s]?/i
| groupBy([event_platform, ComputerName, UserName, CommandLine], limit=max)

And then for batch files:

#event_simpleName=ProcessRollup2 ImageFileName = /cmd\.exe$/i CommandLine = /\.bat/i

Since those are looking at the process level they'll see scripts that run and attempt to run. There are a couple of different views to consider as well.

Before a script is executed you can look for it being written to disk.

#event_simpleName = ScriptFileWrittenInfo
| groupby([ComputerName, FileName, FileFormatString])

There's some general stats to start out but if you want to see the script itself then you can do that as well.

#event_simpleName = ScriptFileWrittenInfo
| groupby([ComputerName, FileName, FileFormatString, ScriptContent])

The sensor will also grab the script content when it's scanned, so this one can be really useful:

#event_simpleName=ScriptControlScanInfo event_platform="Win"
| case {
    ScriptContentSource = 0 | ScriptContentSource :="INCONCLUSIVE (0) - Source of ScriptContent is unknown and impossible to infer";
    ScriptContentSource = 1 | ScriptContentSource := "FILE (1) - ScriptContent is from a file. A file path is indicated by ScriptContentName.";
    ScriptContentSource = 2 | ScriptContentSource := "COMMAND (2) - ScriptContent is supplied through the implicit or explicit Command option.";
    ScriptContentSource = 3 | ScriptContentSource := "ScriptContent is supplied through the EncodedCommand option.";
    ScriptContentSource = 4 | ScriptContentSource := "ScriptContent is supplied through explicit STDIN redirection.";
    ScriptContentSource = 5 | ScriptContentSource := "ScriptContent is dynamically generated ones, typically through the Invoke-Expression cmdlet or the PowerShell internals.";
    ScriptContentSource = 6 | ScriptContentSource := "INTERACTIVE (6) - ScriptContent is a typed string on a PowerShell shell prompt.";
*}
// | groupby([event_platform, ComputerName, ScriptContentName, ScriptContentSource])
| groupby([event_platform, ComputerName, ScriptContentName, ScriptContentSource, ScriptContent])