KQL_win_shell_spawn_susp_program.txt

SecurityEvent | where EventID == "4688" | where ((ParentImage endswith "\\mshta.exe" or ParentImage endswith "\\powershell.exe" or ParentImage endswith "\\cmd.exe" or ParentImage endswith "\\rundll32.exe" or ParentImage endswith "\\cscript.exe" or ParentImage endswith "\\wscript.exe" or ParentImage endswith "\\wmiprvse.exe" and Image endswith "\\schtasks.exe" or Image endswith "\\nslookup.exe" or Image endswith "\\certutil.exe" or Image endswith "\\bitsadmin.exe" or Image endswith "\\mshta.exe") and not (CurrentDirectory contains "\\ccmcache\\"))