Based on the provided information, it appears that the attacker was able to bypass application whitelisting by emailing a spreadsheet attachment with an embedded PowerShell in the file, as indicated by the "New Process" event with the process name "lat.ps1" and the "Creator Process Name" of "powershell.exe". This suggests that the attacker was able to execute a PowerShell script to run malicious code.