yyy_a_Detection - Windows_4688.json

{
  "flows": [
    {
      "name": "yyy_a_Detection - Windows_4688",
      "nodes": [
        {
          "id": "a10f2e17-c209-497b-b29b-4d1e395275bf",
          "name": "InstallUtil_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00604' AS alert_id, 'InstallUtil Technique' AS alert_type, 'Execution' AS tactic, 'InstallUtil' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%installutil%' OR lower(creatorProcessName) like '%installutil%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 2400,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "d5c70484-6179-4178-808a-98a7a3a8c2d4",
          "name": "Execution_of_Trusted_Developer_Utilities",
          "kind": "augmentation",
          "lql": "`select 'LH00608' AS alert_id, 'Execution of Trusted Developer Utilities' AS alert_type, 'Execution' AS tactic, 'Trusted Developer Utilities' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine)) AS additional_data FROM Clean_data where (\nlower(newProcessName) like '%msbuild.exe%' OR lower(creatorProcessName) like '%msbuild.exe%' OR\nlower(newProcessName) like '%dnx.exe%' OR lower(creatorProcessName) like '%dnx.exe%' OR\nlower(newProcessName) like '%rcsi.exe%' OR lower(creatorProcessName) like '%rcsi.exe%' OR\nlower(newProcessName) like '%windbg.exe%' OR lower(creatorProcessName) like '%windbg.exe%' OR\nlower(newProcessName) like '%cdb.exe%' OR lower(creatorProcessName) like '%cdb.exe%' OR\nlower(newProcessName) like '%tracker.exe%' OR lower(creatorProcessName) like '%tracker.exe%'\n)`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 300,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "773e51b6-73a5-4750-93ca-63e406394c64",
          "name": "Execution_of_program_dot_exe",
          "kind": "augmentation",
          "lql": "`select 'LH00710' AS alert_id, 'Execution of program.exe' AS alert_type, 'Privilege Escalation' AS tactic, 'Path Interception' AS technique, 6.0 AS lhub_score, 2.0 AS risk_score, 3.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like 'c:\\\\program.exe' OR lower(creatorProcessName) like 'c:\\\\program,exe')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 2100,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "f4bda0af-023f-4e3e-a41a-a075b4f34b1b",
          "name": "Rundll32_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00612' AS alert_id, 'Rundll32 Technique' AS alert_type, 'Execution' AS tactic, 'Rundll32' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%rundll32%' OR lower(creatorProcessName) like '%rundll32%') AND NOT(creatorAccountName like '%$') AND creatorAccountName != 'LOCAL SERVICE'`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 1200,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "6691e609-917d-4754-85d8-8179b6d47d3d",
          "name": "LogicHub_MDR_Format_Alert_for_Sumo_1",
          "kind": "step",
          "inputs": [
            "ed9c9dfe-4f1c-4409-bd6b-cad32650d9d9"
          ],
          "isLeaf": false,
          "warnings": [],
          "description": "Format event output to send to SumoLogic destination",
          "isExplainable": true,
          "x": 3150,
          "y": 468,
          "vertices": [],
          "title": "LogicHub MDR: Format Alert for Sumo",
          "moduleId": "logichub.mdr.format_alert_for_sumo",
          "moduleVersion": {
            "majorVersion": 1,
            "minorVersion": 31,
            "patchVersion": 0,
            "contentResourceVersionBranch": "Local"
          },
          "moduleParameters": {
            "parent0": "Join_all_indicators"
          },
          "stepParams": {
            "kind": "module",
            "title": "LogicHub MDR: Format Alert for Sumo"
          },
          "isEditable": true,
          "isStepImplementable": false,
          "executionDependsOn": [],
          "contentMetadata": {
            "id": "logichub.mdr.format_alert_for_sumo",
            "name": "LogicHub MDR: Format Alert for Sumo",
            "latestAvailableVersion": {
              "majorVersion": 1,
              "minorVersion": 31,
              "patchVersion": 0,
              "contentResourceVersionBranch": "Local"
            }
          },
          "outputtedNode": true,
          "contentItemIdentifier": {
            "kind": "ModuleContentKind",
            "id": "logichub.mdr.format_alert_for_sumo"
          },
          "categoryKind": "Module",
          "iconTitle": "Module: LogicHub MDR: Format Alert for Sumo",
          "usedByEventTypes": []
        },
        {
          "id": "54ce045a-9be8-4fa3-9609-251e51a89296",
          "name": "Compiled_HTML_File_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00602' AS alert_id, 'Compiled HTML File Technique' AS alert_type, 'Execution' AS tactic, 'Compiled HTML File' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%hh.exe%' OR lower(creatorProcessName) like '%hh.exe%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 4500,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "f51866d5-ece2-495b-b037-f38c727382a2",
          "name": "MS_Office_spawning_child_process",
          "kind": "augmentation",
          "lql": "`select 'LH00603' AS alert_id, 'MS Office spawning child process' AS alert_type, 'Execution' AS tactic, 'Dynamic Data Exchange' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where lower(creatorProcessName) like '%office%'`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 5100,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "a642a1f8-6a7d-4f6e-859b-cfdd89069e57",
          "name": "Possible_Data_Encrypted_For_Impact",
          "kind": "augmentation",
          "lql": "`select 'LH00613' AS alert_id, 'Possible Data Encrypted For Impact' AS alert_type, 'Impact' AS tactic, 'Data Encrypted for Impact' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine)) AS additional_data FROM Clean_data where (\nlower(newProcessName) like '%vssadmin%' OR lower(creatorProcessName) like '%vssadmin%' OR\nlower(newProcessName) like '%wbadmin%' OR lower(creatorProcessName) like '%wbadmin%' OR\nlower(newProcessName) like '%bcdedit%' OR lower(creatorProcessName) like '%bcdedit%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3000,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "ed9c9dfe-4f1c-4409-bd6b-cad32650d9d9",
          "name": "Join_all_indicators",
          "kind": "augmentation",
          "lql": "unionAll(CMSTP_Technique, Compiled_HTML_File_Technique, MS_Office_spawning_child_process, InstallUtil_Technique, Mshta_Technique, Regsvcs_or_Regasm_Technique, Regsvr32_Technique, Execution_of_Trusted_Developer_Utilities, XSL_Script_Processing, Possible_replication_through_removable_media, Windows_Remote_Management, Rundll32_Technique, Possible_Data_Encrypted_For_Impact, Possible_System_Recovery_Inhibited, Windows_executable_run_outside_windows_directory, Execution_of_setmyparent, SDBINST_Execution, Office_spawning_scripting_tool, Execution_of_program_dot_exe, Execution_of_fdump, Use_of_software_packing_utility, Executable_not_drive_c)",
          "operator": "unionAll",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3150,
          "y": 356,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "OperatorForm",
          "contentItemIdentifier": {
            "kind": "OperatorContentKind",
            "id": "unionAll"
          },
          "categoryKind": "Transform",
          "iconTitle": "Transform: Union All",
          "usedByEventTypes": []
        },
        {
          "id": "436b54c0-1048-4d88-9eff-24b8308fc049",
          "name": "Windows_Remote_Management",
          "kind": "augmentation",
          "lql": "`select 'LH00611' AS alert_id, 'Windows Remote Management' AS alert_type, 'Execution' AS tactic, 'Windows Remote Management' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%winrm%' OR lower(creatorProcessName) like '%winrm%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 4200,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "029566ad-b769-4f0e-bd66-316109d43af7",
          "name": "Regsvr32_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00607' AS alert_id, 'Regsvr32 Technique' AS alert_type, 'Execution' AS tactic, 'Regsvr32' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%regsvr32%' OR lower(creatorProcessName) like '%regsvr32%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 1800,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "bb3985ad-69bc-4eb0-8e8d-db056a2b9c27",
          "name": "Clean_data",
          "kind": "augmentation",
          "lql": "`select lhub_ts, _blockid, _collector, _collectorid, _format, _messagecount, _messageid, _messagetime, _raw, _receipttime, _size, _source, _sourcecategory, _sourcehost, _sourceid, _sourcename, _view, event_id, msg_summary, _some_matched, regexp_extract(newProcessName, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) AS newProcessName, regexp_extract(creatorProcessName, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) AS creatorProcessName, regexp_extract(creatorAccountName, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) AS creatorAccountName, regexp_extract(processCommandLine, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) as processCommandLine,\nregexp_extract(creatorProcessId, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) AS creatorProcessId, regexp_extract(newProcessId, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) AS newProcessId, regexp_extract(src_machine_name, '^[\\t+|\\s+|\\r+\\n+]*(.+?)[\\t+|\\s+|\\r+\\n+]*$', 1) as src_machine_name from Windows_Event_4688`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3150,
          "y": 112,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "4c1461e6-8d4e-4970-b935-e7ff85c025c6",
          "name": "XSL_Script_Processing",
          "kind": "augmentation",
          "lql": "`select 'LH00609' AS alert_id, 'XSL Script Processing' AS alert_type, 'Execution' AS tactic, 'XSL Script Processing' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%msxsl%' OR lower(creatorProcessName) like '%msxsl%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 900,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "90df5a6f-2e56-4157-90f9-e87938fe9f03",
          "name": "Windows_executable_run_outside_windows_directory",
          "kind": "augmentation",
          "lql": "`select 'LH00706' AS alert_id, 'Windows Executable Run Outside Windows Directory' AS alert_type, 'Privilege Escalation' AS tactic, 'Path Interception' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where  \n(newProcessName like '%agentactivationruntimestarter.exe'\nOR newProcessName like '%agentservice.exe'\nOR newProcessName like '%aitstatic.exe'\nOR newProcessName like '%alg.exe'\nOR newProcessName like '%amdocl_as64.exe'\nOR newProcessName like '%amdocl_ld64.exe'\nOR newProcessName like '%apphostregistrationverifier.exe'\nOR newProcessName like '%appidcertstorecheck.exe'\nOR newProcessName like '%appidpolicyconverter.exe'\nOR newProcessName like '%appidtel.exe'\nOR newProcessName like '%applicationframehost.exe'\nOR newProcessName like '%applysettingstemplatecatalog.exe'\nOR newProcessName like '%applytrustoffline.exe'\nOR newProcessName like '%approvechildrequest.exe'\nOR newProcessName like '%appvclient.exe'\nOR newProcessName like '%appvdllsurrogate.exe'\nOR newProcessName like '%appvnice.exe'\nOR newProcessName like '%appvshnotify.exe'\nOR newProcessName like '%arp.exe'\nOR newProcessName like '%at.exe'\nOR newProcessName like '%atbroker.exe'\nOR newProcessName like '%atiapfxx.exe'\nOR newProcessName like '%atieah64.exe'\nOR newProcessName like '%atieclxx.exe'\nOR newProcessName like '%atiesrxx.exe'\nOR newProcessName like '%atiodcli.exe'\nOR newProcessName like '%atiode.exe'\nOR newProcessName like '%attrib.exe'\nOR newProcessName like '%audiodg.exe'\nOR newProcessName like '%auditpol.exe'\nOR newProcessName like '%authhost.exe'\nOR newProcessName like '%autochk.exe'\nOR newProcessName like '%autoconv.exe'\nOR newProcessName like '%autofmt.exe'\nOR newProcessName like '%axinstui.exe'\nOR newProcessName like '%baaupdate.exe'\nOR newProcessName like '%backgroundtaskhost.exe'\nOR newProcessName like '%backgroundtransferhost.exe'\nOR newProcessName like '%bcdboot.exe'\nOR newProcessName like '%bcdedit.exe'\nOR newProcessName like '%bdechangepin.exe'\nOR newProcessName like '%bdehdcfg.exe'\nOR newProcessName like '%bdeuisrv.exe'\nOR newProcessName like '%bdeunlock.exe'\nOR newProcessName like '%bioiso.exe'\nOR newProcessName like '%bitlockerdeviceencryption.exe'\nOR newProcessName like '%bitlockerwizard.exe'\nOR newProcessName like '%bitlockerwizardelev.exe'\nOR newProcessName like '%bitsadmin.exe'\nOR newProcessName like '%bootcfg.exe'\nOR newProcessName like '%bootim.exe'\nOR newProcessName like '%bootsect.exe'\nOR newProcessName like '%bridgeunattend.exe'\nOR newProcessName like '%browserexport.exe'\nOR newProcessName like '%browser_broker.exe'\nOR newProcessName like '%bthudtask.exe'\nOR newProcessName like '%bytecodegenerator.exe'\nOR newProcessName like '%cacls.exe'\nOR newProcessName like '%calc.exe'\nOR newProcessName like '%camerasettingsuihost.exe'\nOR newProcessName like '%castsrv.exe'\nOR newProcessName like '%certenrollctrl.exe'\nOR newProcessName like '%certreq.exe'\nOR newProcessName like '%certutil.exe'\nOR newProcessName like '%change.exe'\nOR newProcessName like '%changepk.exe'\nOR newProcessName like '%charmap.exe'\nOR newProcessName like '%checknetisolation.exe'\nOR newProcessName like '%chglogon.exe'\nOR newProcessName like '%chgport.exe'\nOR newProcessName like '%chgusr.exe'\nOR newProcessName like '%chkdsk.exe'\nOR newProcessName like '%chkntfs.exe'\nOR newProcessName like '%choice.exe'\nOR newProcessName like '%cidiag.exe'\nOR newProcessName like '%cipher.exe'\nOR newProcessName like '%cleanmgr.exe'\nOR newProcessName like '%cliconfg.exe'\nOR newProcessName like '%clinfo.exe'\nOR newProcessName like '%clip.exe'\nOR newProcessName like '%cliprenew.exe'\nOR newProcessName like '%clipup.exe'\nOR newProcessName like '%cloudexperiencehostbroker.exe'\nOR newProcessName like '%cloudnotifications.exe'\nOR newProcessName like '%cmd.exe'\nOR newProcessName like '%cmdkey.exe'\nOR newProcessName like '%cmdl32.exe'\nOR newProcessName like '%cmmon32.exe'\nOR newProcessName like '%cmstp.exe'\nOR newProcessName like '%cofire.exe'\nOR newProcessName like '%colorcpl.exe'\nOR newProcessName like '%comp.exe'\nOR newProcessName like '%compact.exe'\nOR newProcessName like '%compattelrunner.exe'\nOR newProcessName like '%compmgmtlauncher.exe'\nOR newProcessName like '%comppkgsrv.exe'\nOR newProcessName like '%computerdefaults.exe'\nOR newProcessName like '%conhost.exe'\nOR newProcessName like '%consent.exe'\nOR newProcessName like '%control.exe'\n/* OR newProcessName like '%convert.exe' */\nOR newProcessName like '%convertvhd.exe'\nOR newProcessName like '%coredpussvr.exe'\nOR newProcessName like '%credentialenrollmentmanager.exe'\nOR newProcessName like '%credentialuibroker.exe'\nOR newProcessName like '%credwiz.exe'\nOR newProcessName like '%cscript.exe'\nOR newProcessName like '%csrss.exe'\nOR newProcessName like '%ctfmon.exe'\nOR newProcessName like '%cttune.exe'\nOR newProcessName like '%cttunesvr.exe'\nOR newProcessName like '%curl.exe'\nOR newProcessName like '%custominstallexec.exe'\nOR newProcessName like '%dashost.exe'\nOR newProcessName like '%dataexchangehost.exe'\nOR newProcessName like '%datastorecachedumptool.exe'\nOR newProcessName like '%datausagelivetiletask.exe'\nOR newProcessName like '%dccw.exe'\nOR newProcessName like '%dcomcnfg.exe'\nOR newProcessName like '%ddodiag.exe'\nOR newProcessName like '%defrag.exe'\nOR newProcessName like '%deploymentcsphelper.exe'\nOR newProcessName like '%desktopimgdownldr.exe'\nOR newProcessName like '%devicecensus.exe'\nOR newProcessName like '%devicecredentialdeployment.exe'\nOR newProcessName like '%deviceeject.exe'\nOR newProcessName like '%deviceenroller.exe'\nOR newProcessName like '%devicepairingwizard.exe'\nOR newProcessName like '%deviceproperties.exe'\nOR newProcessName like '%dfdwiz.exe'\nOR newProcessName like '%dfrgui.exe'\nOR newProcessName like '%dialer.exe'\nOR newProcessName like '%difx64.exe'\nOR newProcessName like '%directxdatabaseupdater.exe'\nOR newProcessName like '%diskpart.exe'\nOR newProcessName like '%diskperf.exe'\nOR newProcessName like '%diskraid.exe'\nOR newProcessName like '%disksnapshot.exe'\nOR newProcessName like '%dism.exe'\nOR newProcessName like '%dispdiag.exe'\nOR newProcessName like '%displayswitch.exe'\nOR newProcessName like '%djoin.exe'\nOR newProcessName like '%dllhost.exe'\nOR newProcessName like '%dllhst3g.exe'\nOR newProcessName like '%dmcertinst.exe'\nOR newProcessName like '%dmcfghost.exe'\nOR newProcessName like '%dmclient.exe'\nOR newProcessName like '%dmnotificationbroker.exe'\nOR newProcessName like '%dmomacpmo.exe'\nOR newProcessName like '%dnscacheugc.exe'\nOR newProcessName like '%doskey.exe'\nOR newProcessName like '%dpapimig.exe'\nOR newProcessName like '%dpiscaling.exe'\nOR newProcessName like '%dpnsvr.exe'\nOR newProcessName like '%dptopologyapp.exe'\nOR newProcessName like '%dptopologyappv2_0.exe'\nOR newProcessName like '%driverquery.exe'\nOR newProcessName like '%drvcfg.exe'\nOR newProcessName like '%drvinst.exe'\nOR newProcessName like '%dsmusertask.exe'\nOR newProcessName like '%dsregcmd.exe'\nOR newProcessName like '%dstokenclean.exe'\nOR newProcessName like '%dtuhandler.exe'\nOR newProcessName like '%dusmtask.exe'\nOR newProcessName like '%dvdplay.exe'\nOR newProcessName like '%dwm.exe'\nOR newProcessName like '%dwwin.exe'\nOR newProcessName like '%dxdiag.exe'\nOR newProcessName like '%dxgiadaptercache.exe'\nOR newProcessName like '%dxpserver.exe'\nOR newProcessName like '%eap3host.exe'\nOR newProcessName like '%easeofaccessdialog.exe'\nOR newProcessName like '%easinvoker.exe'\nOR newProcessName like '%easpolicymanagerbrokerhost.exe'\nOR newProcessName like '%edpcleanup.exe'\nOR newProcessName like '%edpnotify.exe'\nOR newProcessName like '%eduprintprov.exe'\nOR newProcessName like '%efsui.exe'\nOR newProcessName like '%ehstorauthn.exe'\nOR newProcessName like '%esentutl.exe'\nOR newProcessName like '%eudcedit.exe'\nOR newProcessName like '%eventcreate.exe'\nOR newProcessName like '%eventvwr.exe'\nOR newProcessName like '%expand.exe'\nOR newProcessName like '%extrac32.exe'\nOR newProcessName like '%fc.exe'\nOR newProcessName like '%fhmanagew.exe'\nOR newProcessName like '%filehistory.exe'\nOR newProcessName like '%find.exe'\nOR newProcessName like '%findstr.exe'\nOR newProcessName like '%finger.exe'\nOR newProcessName like '%fixmapi.exe'\nOR newProcessName like '%fltmc.exe'\nOR newProcessName like '%fodhelper.exe'\nOR newProcessName like '%fondue.exe'\nOR newProcessName like '%fontdrvhost.exe'\nOR newProcessName like '%fontview.exe'\nOR newProcessName like '%forfiles.exe'\nOR newProcessName like '%fsavailux.exe'\nOR newProcessName like '%fsiso.exe'\nOR newProcessName like '%fsquirt.exe'\nOR newProcessName like '%fsutil.exe'\nOR newProcessName like '%ftp.exe'\nOR newProcessName like '%fvenotify.exe'\nOR newProcessName like '%fveprompt.exe'\nOR newProcessName like '%fxscover.exe'\nOR newProcessName like '%fxssvc.exe'\nOR newProcessName like '%fxsunatd.exe'\nOR newProcessName like '%gamebarpresencewriter.exe'\nOR newProcessName like '%gamepanel.exe'\nOR newProcessName like '%genvalobj.exe'\nOR newProcessName like '%getmac.exe'\nOR newProcessName like '%gfxuiex.exe'\nOR newProcessName like '%gfxv2_0.exe'\nOR newProcessName like '%gfxv4_0.exe'\nOR newProcessName like '%gpresult.exe'\nOR newProcessName like '%gpscript.exe'\nOR newProcessName like '%gpupdate.exe'\nOR newProcessName like '%grpconv.exe'\nOR newProcessName like '%hdwwiz.exe'\nOR newProcessName like '%help.exe'\nOR newProcessName like '%hostname.exe'\nOR newProcessName like '%hvax64.exe'\nOR newProcessName like '%hvix64.exe'\nOR newProcessName like '%hvsievaluator.exe'\nOR newProcessName like '%ibtsiva.exe'\nOR newProcessName like '%icacls.exe'\nOR newProcessName like '%icsentitlementhost.exe'\nOR newProcessName like '%icsunattend.exe'\nOR newProcessName like '%ie4uinit.exe'\nOR newProcessName like '%ie4ushowie.exe'\nOR newProcessName like '%ieunatt.exe'\nOR newProcessName like '%iexpress.exe'\nOR newProcessName like '%igfxcuiservice.exe'\nOR newProcessName like '%igfxem.exe'\nOR newProcessName like '%igfxext.exe'\nOR newProcessName like '%igfxhk.exe'\nOR newProcessName like '%igfxsdk.exe'\nOR newProcessName like '%igfxtray.exe'\nOR newProcessName like '%immersivetpmvscmgrsvr.exe'\nOR newProcessName like '%infdefaultinstall.exe'\nOR newProcessName like '%inputswitchtoasthandler.exe'\nOR newProcessName like '%intelcphdcpsvc.exe'\nOR newProcessName like '%iotstartup.exe'\nOR newProcessName like '%ipconfig.exe'\nOR newProcessName like '%iscsicli.exe'\nOR newProcessName like '%iscsicpl.exe'\nOR newProcessName like '%isoburn.exe'\nOR newProcessName like '%klist.exe'\nOR newProcessName like '%ksetup.exe'\nOR newProcessName like '%ktmutil.exe'\nOR newProcessName like '%label.exe'\nOR newProcessName like '%languagecomponentsinstallercomhandler.exe'\nOR newProcessName like '%launchtm.exe'\nOR newProcessName like '%launchwinapp.exe'\nOR newProcessName like '%legacynetuxhost.exe'\nOR newProcessName like '%licensemanagershellext.exe'\nOR newProcessName like '%licensingdiag.exe'\nOR newProcessName like '%licensingui.exe'\nOR newProcessName like '%locationnotificationwindows.exe'\nOR newProcessName like '%locator.exe'\nOR newProcessName like '%lockapphost.exe'\nOR newProcessName like '%lockscreencontentserver.exe'\nOR newProcessName like '%lodctr.exe'\nOR newProcessName like '%logagent.exe'\nOR newProcessName like '%logman.exe'\nOR newProcessName like '%logoff.exe'\nOR newProcessName like '%logonui.exe'\nOR newProcessName like '%lpkinstall.exe'\nOR newProcessName like '%lpksetup.exe'\nOR newProcessName like '%lpremove.exe'\nOR newProcessName like '%lsaiso.exe'\nOR newProcessName like '%lsass.exe'\nOR newProcessName like '%magnify.exe'\nOR newProcessName like '%makecab.exe'\nOR newProcessName like '%manage-bde.exe'\nOR newProcessName like '%mavinject.exe'\nOR newProcessName like '%maxxaudiometers64.exe'\nOR newProcessName like '%mbaeparsertask.exe'\nOR newProcessName like '%mblctr.exe'\nOR newProcessName like '%mbr2gpt.exe'\nOR newProcessName like '%mcbuilder.exe'\nOR newProcessName like '%mdeserver.exe'\nOR newProcessName like '%mdmagent.exe'\nOR newProcessName like '%mdmappinstaller.exe'\nOR newProcessName like '%mdmdiagnosticstool.exe'\nOR newProcessName like '%mdres.exe'\nOR newProcessName like '%mdsched.exe'\nOR newProcessName like '%mfpmp.exe'\nOR newProcessName like '%microsoft.uev.cscunpintool.exe'\nOR newProcessName like '%microsoft.uev.synccontroller.exe'\nOR newProcessName like '%microsoftedgebchost.exe'\nOR newProcessName like '%microsoftedgecp.exe'\nOR newProcessName like '%microsoftedgedevtools.exe'\nOR newProcessName like '%microsoftedgesh.exe'\nOR newProcessName like '%mitigationscanner.exe'\nOR newProcessName like '%mmc.exe'\nOR newProcessName like '%mmgaserver.exe'\nOR newProcessName like '%mobsync.exe'\nOR newProcessName like '%mountvol.exe'\nOR newProcessName like '%mousocoreworker.exe'\nOR newProcessName like '%mpnotify.exe'\nOR newProcessName like '%mpsigstub.exe'\nOR newProcessName like '%mrinfo.exe'\nOR newProcessName like '%mrt.exe'\nOR newProcessName like '%mschedexe.exe'\nOR newProcessName like '%msconfig.exe'\nOR newProcessName like '%msdt.exe'\nOR newProcessName like '%msdtc.exe'\nOR newProcessName like '%msfeedssync.exe'\nOR newProcessName like '%msg.exe'\nOR newProcessName like '%mshta.exe'\nOR newProcessName like '%msiexec.exe'\nOR newProcessName like '%msinfo32.exe'\nOR newProcessName like '%mspaint.exe'\nOR newProcessName like '%msra.exe'\nOR newProcessName like '%msspellcheckinghost.exe'\nOR newProcessName like '%mstsc.exe'\nOR newProcessName like '%mtstocom.exe'\nOR newProcessName like '%muiunattend.exe'\nOR newProcessName like '%multidigimon.exe'\nOR newProcessName like '%musnotification.exe'\nOR newProcessName like '%musnotificationux.exe'\nOR newProcessName like '%musnotifyicon.exe'\nOR newProcessName like '%narrator.exe'\nOR newProcessName like '%nbtstat.exe'\nOR newProcessName like '%ndadmin.exe'\nOR newProcessName like '%ndkping.exe'\nOR newProcessName like '%net.exe'\nOR newProcessName like '%net1.exe'\nOR newProcessName like '%netbtugc.exe'\nOR newProcessName like '%netcfg.exe'\nOR newProcessName like '%netcfgnotifyobjecthost.exe'\nOR newProcessName like '%netevtfwdr.exe'\nOR newProcessName like '%nethost.exe'\nOR newProcessName like '%netiougc.exe'\nOR newProcessName like '%netplwiz.exe'\nOR newProcessName like '%netsh.exe'\nOR newProcessName like '%netstat.exe'\nOR newProcessName like '%newdev.exe'\nOR newProcessName like '%ngciso.exe'\nOR newProcessName like '%nltest.exe'\nOR newProcessName like '%notepad.exe'\nOR newProcessName like '%nslookup.exe'\nOR newProcessName like '%ntoskrnl.exe'\nOR newProcessName like '%ntprint.exe'\nOR newProcessName like '%nvwmi64.exe'\nOR newProcessName like '%odbcad32.exe'\nOR newProcessName like '%odbcconf.exe'\nOR newProcessName like '%ofdeploy.exe'\nOR newProcessName like '%omadmclient.exe'\nOR newProcessName like '%omadmprc.exe'\nOR newProcessName like '%openfiles.exe'\nOR newProcessName like '%openwith.exe'\nOR newProcessName like '%optionalfeatures.exe'\nOR newProcessName like '%osk.exe'\nOR newProcessName like '%pacjsworker.exe'\nOR newProcessName like '%packagedcwalauncher.exe'\nOR newProcessName like '%packageinspector.exe'\nOR newProcessName like '%passwordonwakesettingflyout.exe'\nOR newProcessName like '%pathping.exe'\nOR newProcessName like '%pcalua.exe'\nOR newProcessName like '%pcaui.exe'\nOR newProcessName like '%pcwrun.exe'\nOR newProcessName like '%perfmon.exe'\nOR newProcessName like '%phoneactivate.exe'\nOR newProcessName like '%pickerhost.exe'\nOR newProcessName like '%pinenrollmentbroker.exe'\nOR newProcessName like '%ping.exe'\nOR newProcessName like '%pkgmgr.exe'\nOR newProcessName like '%pktmon.exe'\nOR newProcessName like '%plasrv.exe'\nOR newProcessName like '%pnpunattend.exe'\nOR newProcessName like '%pnputil.exe'\nOR newProcessName like '%poqexec.exe'\nOR newProcessName like '%pospaymentsworker.exe'\nOR newProcessName like '%powercfg.exe'\nOR newProcessName like '%presentationhost.exe'\nOR newProcessName like '%presentationsettings.exe'\nOR newProcessName like '%prevhost.exe'\nOR newProcessName like '%print.exe'\nOR newProcessName like '%printbrmui.exe'\nOR newProcessName like '%printfilterpipelinesvc.exe'\nOR newProcessName like '%printisolationhost.exe'\nOR newProcessName like '%printui.exe'\nOR newProcessName like '%proquota.exe'\nOR newProcessName like '%provlaunch.exe'\nOR newProcessName like '%provtool.exe'\nOR newProcessName like '%proximityuxhost.exe'\nOR newProcessName like '%prproc.exe'\nOR newProcessName like '%psr.exe'\nOR newProcessName like '%pwcreator.exe'\nOR newProcessName like '%pwlauncher.exe'\nOR newProcessName like '%qappsrv.exe'\nOR newProcessName like '%qprocess.exe'\nOR newProcessName like '%query.exe'\nOR newProcessName like '%quickassist.exe'\nOR newProcessName like '%quser.exe'\nOR newProcessName like '%qwinsta.exe'\nOR newProcessName like '%rasautou.exe'\nOR newProcessName like '%rasdial.exe'\nOR newProcessName like '%raserver.exe'\nOR newProcessName like '%rasphone.exe'\nOR newProcessName like '%rdpclip.exe'\nOR newProcessName like '%rdpinit.exe'\nOR newProcessName like '%rdpinput.exe'\nOR newProcessName like '%rdpsa.exe'\nOR newProcessName like '%rdpsaproxy.exe'\nOR newProcessName like '%rdpsauachelper.exe'\nOR newProcessName like '%rdpshell.exe'\nOR newProcessName like '%rdpsign.exe'\nOR newProcessName like '%rdrleakdiag.exe'\nOR newProcessName like '%rdvghelper.exe'\nOR newProcessName like '%reagentc.exe'\nOR newProcessName like '%recdisc.exe'\nOR newProcessName like '%recover.exe'\nOR newProcessName like '%recoverydrive.exe'\nOR newProcessName like '%refsutil.exe'\nOR newProcessName like '%reg.exe'\nOR newProcessName like '%regedt32.exe'\nOR newProcessName like '%regini.exe'\nOR newProcessName like '%register-cimprovider.exe'\nOR newProcessName like '%regsvr32.exe'\nOR newProcessName like '%rekeywiz.exe'\nOR newProcessName like '%relog.exe'\nOR newProcessName like '%relpost.exe'\nOR newProcessName like '%remoteapplifetimemanager.exe'\nOR newProcessName like '%remoteposworker.exe'\nOR newProcessName like '%repair-bde.exe'\nOR newProcessName like '%replace.exe'\nOR newProcessName like '%reset.exe'\nOR newProcessName like '%resetengine.exe'\nOR newProcessName like '%resmon.exe'\nOR newProcessName like '%rmactivate.exe'\nOR newProcessName like '%rmactivate_isv.exe'\nOR newProcessName like '%rmactivate_ssp.exe'\nOR newProcessName like '%rmactivate_ssp_isv.exe'\nOR newProcessName like '%rmclient.exe'\nOR newProcessName like '%rmttpmvscmgrsvr.exe'\nOR newProcessName like '%robocopy.exe'\nOR newProcessName like '%route.exe'\nOR newProcessName like '%rpcping.exe'\nOR newProcessName like '%rrinstaller.exe'\nOR newProcessName like '%rstrui.exe'\nOR newProcessName like '%runas.exe'\nOR newProcessName like '%rundll32.exe'\nOR newProcessName like '%runexehelper.exe'\nOR newProcessName like '%runlegacycplelevated.exe'\nOR newProcessName like '%runonce.exe'\nOR newProcessName like '%runtimebroker.exe'\nOR newProcessName like '%rwinsta.exe'\nOR newProcessName like '%sc.exe'\nOR newProcessName like '%schtasks.exe'\nOR newProcessName like '%scriptrunner.exe'\nOR newProcessName like '%sdbinst.exe'\nOR newProcessName like '%sdchange.exe'\nOR newProcessName like '%sdclt.exe'\nOR newProcessName like '%sdiagnhost.exe'\nOR newProcessName like '%searchfilterhost.exe'\nOR newProcessName like '%searchindexer.exe'\nOR newProcessName like '%searchprotocolhost.exe'\nOR newProcessName like '%secedit.exe'\nOR newProcessName like '%secinit.exe'\nOR newProcessName like '%securekernel.exe'\nOR newProcessName like '%securityhealthhost.exe'\nOR newProcessName like '%securityhealthservice.exe'\nOR newProcessName like '%securityhealthsystray.exe'\nOR newProcessName like '%sensordataservice.exe'\nOR newProcessName like '%services.exe'\nOR newProcessName like '%sessionmsg.exe'\nOR newProcessName like '%sethc.exe'\nOR newProcessName like '%setspn.exe'\nOR newProcessName like '%settingsynchost.exe'\nOR newProcessName like '%setupcl.exe'\nOR newProcessName like '%setupugc.exe'\nOR newProcessName like '%setx.exe'\nOR newProcessName like '%sfc.exe'\nOR newProcessName like '%sgrmbroker.exe'\nOR newProcessName like '%sgrmlpac.exe'\nOR newProcessName like '%shrpubw.exe'\nOR newProcessName like '%shutdown.exe'\nOR newProcessName like '%sigverif.exe'\nOR newProcessName like '%sihclient.exe'\nOR newProcessName like '%sihost.exe'\nOR newProcessName like '%slidetoshutdown.exe'\nOR newProcessName like '%slui.exe'\nOR newProcessName like '%smartscreen.exe'\nOR newProcessName like '%smss.exe'\nOR newProcessName like '%sndvol.exe'\nOR newProcessName like '%snippingtool.exe'\nOR newProcessName like '%snmptrap.exe'\nOR newProcessName like '%sort.exe'\nOR newProcessName like '%spaceagent.exe'\nOR newProcessName like '%spaceman.exe'\nOR newProcessName like '%spatialaudiolicensesrv.exe'\nOR newProcessName like '%spectrum.exe'\nOR newProcessName like '%spoolsv.exe'\nOR newProcessName like '%sppextcomobj.exe'\nOR newProcessName like '%sppsvc.exe'\nOR newProcessName like '%srdelayed.exe'\nOR newProcessName like '%srtasks.exe'\nOR newProcessName like '%stordiag.exe'\nOR newProcessName like '%subst.exe'\nOR newProcessName like '%svchost.exe'\nOR newProcessName like '%sxstrace.exe'\nOR newProcessName like '%syncappvpublishingserver.exe'\nOR newProcessName like '%synchost.exe'\nOR newProcessName like '%sysreseterr.exe'\nOR newProcessName like '%systeminfo.exe'\nOR newProcessName like '%systempropertiesadvanced.exe'\nOR newProcessName like '%systempropertiescomputername.exe'\nOR newProcessName like '%systempropertiesdataexecutionprevention.exe'\nOR newProcessName like '%systempropertieshardware.exe'\nOR newProcessName like '%systempropertiesperformance.exe'\nOR newProcessName like '%systempropertiesprotection.exe'\nOR newProcessName like '%systempropertiesremote.exe'\nOR newProcessName like '%systemreset.exe'\nOR newProcessName like '%systemsettingsadminflows.exe'\nOR newProcessName like '%systemsettingsbroker.exe'\nOR newProcessName like '%systemsettingsremovedevice.exe'\nOR newProcessName like '%systemuwplauncher.exe'\nOR newProcessName like '%systray.exe'\nOR newProcessName like '%tabcal.exe'\nOR newProcessName like '%takeown.exe'\nOR newProcessName like '%tapiunattend.exe'\nOR newProcessName like '%tar.exe'\nOR newProcessName like '%taskhostw.exe'\nOR newProcessName like '%taskkill.exe'\nOR newProcessName like '%tasklist.exe'\nOR newProcessName like '%taskmgr.exe'\nOR newProcessName like '%tcblaunch.exe'\nOR newProcessName like '%tcmsetup.exe'\nOR newProcessName like '%tcpsvcs.exe'\nOR newProcessName like '%telnet.exe'\nOR newProcessName like '%thumbnailextractionhost.exe'\nOR newProcessName like '%tieringengineservice.exe'\nOR newProcessName like '%timeout.exe'\nOR newProcessName like '%tokenbrokercookies.exe'\nOR newProcessName like '%tpminit.exe'\nOR newProcessName like '%tpmvscmgr.exe'\nOR newProcessName like '%tpmvscmgrsvr.exe'\nOR newProcessName like '%tracerpt.exe'\nOR newProcessName like '%tracert.exe'\nOR newProcessName like '%tscon.exe'\nOR newProcessName like '%tsdiscon.exe'\nOR newProcessName like '%tskill.exe'\nOR newProcessName like '%tstheme.exe'\nOR newProcessName like '%tswbprxy.exe'\nOR newProcessName like '%tswpfwrp.exe'\nOR newProcessName like '%ttdinject.exe'\nOR newProcessName like '%tttracer.exe'\nOR newProcessName like '%typeperf.exe'\nOR newProcessName like '%tzsync.exe'\nOR newProcessName like '%tzutil.exe'\nOR newProcessName like '%ucsvc.exe'\nOR newProcessName like '%uevagentpolicygenerator.exe'\nOR newProcessName like '%uevappmonitor.exe'\nOR newProcessName like '%uevtemplatebaselinegenerator.exe'\nOR newProcessName like '%uevtemplateconfigitemgenerator.exe'\nOR newProcessName like '%uimgrbroker.exe'\nOR newProcessName like '%unlodctr.exe'\nOR newProcessName like '%unregmp2.exe'\nOR newProcessName like '%upfc.exe'\nOR newProcessName like '%upgraderesultsui.exe'\nOR newProcessName like '%upnpcont.exe'\nOR newProcessName like '%useraccountbroker.exe'\nOR newProcessName like '%useraccountcontrolsettings.exe'\nOR newProcessName like '%userinit.exe'\nOR newProcessName like '%usoclient.exe'\nOR newProcessName like '%usocoreworker.exe'\nOR newProcessName like '%utcdecoderhost.exe'\nOR newProcessName like '%utilman.exe'\nOR newProcessName like '%vaultcmd.exe'\nOR newProcessName like '%vds.exe'\nOR newProcessName like '%vdsldr.exe'\nOR newProcessName like '%verclsid.exe'\nOR newProcessName like '%verifier.exe'\nOR newProcessName like '%verifiergui.exe'\nOR newProcessName like '%vssadmin.exe'\nOR newProcessName like '%vssvc.exe'\nOR newProcessName like '%vulkaninfo-1-999-0-0-0.exe'\nOR newProcessName like '%vulkaninfo.exe'\nOR newProcessName like '%w32tm.exe'\nOR newProcessName like '%waasmedicagent.exe'\nOR newProcessName like '%waitfor.exe'\nOR newProcessName like '%wallpaperhost.exe'\nOR newProcessName like '%wbadmin.exe'\nOR newProcessName like '%wbengine.exe'\nOR newProcessName like '%wecutil.exe'\nOR newProcessName like '%werfault.exe'\nOR newProcessName like '%werfaultsecure.exe'\nOR newProcessName like '%wermgr.exe'\nOR newProcessName like '%wevtutil.exe'\nOR newProcessName like '%wextract.exe'\nOR newProcessName like '%wfs.exe'\nOR newProcessName like '%where.exe'\nOR newProcessName like '%whoami.exe'\nOR newProcessName like '%wiaacmgr.exe'\nOR newProcessName like '%wiawow64.exe'\nOR newProcessName like '%wifitask.exe'\nOR newProcessName like '%wimserv.exe'\nOR newProcessName like '%winbiodatamodeloobe.exe'\nOR newProcessName like '%windows.media.backgroundplayback.exe'\nOR newProcessName like '%windows.warp.jitservice.exe'\nOR newProcessName like '%windowsactiondialog.exe'\nOR newProcessName like '%windowsupdateelevatedinstaller.exe'\nOR newProcessName like '%wininit.exe'\nOR newProcessName like '%winload.exe'\nOR newProcessName like '%winlogon.exe'\nOR newProcessName like '%winresume.exe'\nOR newProcessName like '%winrs.exe'\nOR newProcessName like '%winrshost.exe'\nOR newProcessName like '%winrtnetmuahostserver.exe'\nOR newProcessName like '%winsat.exe'\nOR newProcessName like '%winver.exe'\nOR newProcessName like '%wkspbroker.exe'\nOR newProcessName like '%wksprt.exe'\nOR newProcessName like '%wlanext.exe'\nOR newProcessName like '%wlrmdr.exe'\nOR newProcessName like '%wmpdmc.exe'\nOR newProcessName like '%workfolders.exe'\nOR newProcessName like '%wowreg32.exe'\nOR newProcessName like '%wpcmon.exe'\nOR newProcessName like '%wpctok.exe'\nOR newProcessName like '%wpdshextautoplay.exe'\nOR newProcessName like '%wpnpinst.exe'\nOR newProcessName like '%wpr.exe'\nOR newProcessName like '%write.exe'\nOR newProcessName like '%wscadminui.exe'\nOR newProcessName like '%wscollect.exe'\nOR newProcessName like '%wscript.exe'\nOR newProcessName like '%wsmanhttpconfig.exe'\nOR newProcessName like '%wsmprovhost.exe'\nOR newProcessName like '%wsqmcons.exe'\nOR newProcessName like '%wsreset.exe'\nOR newProcessName like '%wuapihost.exe'\nOR newProcessName like '%wuauclt.exe'\nOR newProcessName like '%wudfcompanionhost.exe'\nOR newProcessName like '%wudfhost.exe'\nOR newProcessName like '%wusa.exe'\nOR newProcessName like '%wwahost.exe'\nOR newProcessName like '%xblgamesavetask.exe'\nOR newProcessName like '%xcopy.exe'\nOR newProcessName like '%xwizard.exe'\nOR newProcessName like '%appvstreamingux.exe'\nOR newProcessName like '%winload.exe'\nOR newProcessName like '%winresume.exe'\nOR newProcessName like '%comrepl.exe'\nOR newProcessName like '%migregdb.exe'\nOR newProcessName like '%diagnosticshub.standardcollector.service.exe'\nOR newProcessName like '%dismhost.exe'\nOR newProcessName like '%sysprep.exe'\nOR newProcessName like '%systemresetplatform.exe'\nOR newProcessName like '%unpuxhost.exe'\nOR newProcessName like '%unpuxlauncher.exe'\nOR newProcessName like '%updatenotificationmgr.exe'\nOR newProcessName like '%mofcomp.exe'\nOR newProcessName like '%scrcons.exe'\nOR newProcessName like '%unsecapp.exe'\nOR newProcessName like '%wbemtest.exe'\nOR newProcessName like '%winmgmt.exe'\nOR newProcessName like '%wmiadap.exe'\nOR newProcessName like '%wmiapsrv.exe'\nOR newProcessName like '%wmic.exe'\nOR newProcessName like '%wmiprvse.exe'\nOR newProcessName like '%powershell.exe'\nOR newProcessName like '%powershell_ise.exe'\nOR newProcessName like '%bfsvc.exe'\nOR newProcessName like '%explorer.exe'\nOR newProcessName like '%helppane.exe'\nOR newProcessName like '%hh.exe'\nOR newProcessName like '%notepad.exe'\nOR newProcessName like '%regedit.exe'\nOR newProcessName like '%splwow64.exe'\nOR newProcessName like '%winhlp32.exe'\nOR newProcessName like '%write.exe')\nAND NOT(lower(newProcessName) like 'c:\\\\windows%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 6000,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "18320535-dbfc-4d27-9de8-f736a3e5e1b6",
          "name": "Use_of_software_packing_utility",
          "kind": "augmentation",
          "lql": "`select 'LH00715' AS alert_id, 'Use of software packing utility' AS alert_type, 'Defense Evasion' AS tactic, 'Software Packing' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%mpress.exe%' OR lower(creatorProcessName) like '%mpress.exe%' OR lower(newProcessName) like '%upx.exe%' OR lower(creatorProcessName) like '%upx.exe%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 6300,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "cffb4c63-c4e5-4344-bbd1-136d5cc5c13f",
          "name": "Regsvcs_or_Regasm_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00606' AS alert_id, 'Regsvcs or Regasm Technique' AS alert_type, 'Execution' AS tactic, 'Regsvcs/Regasm' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%regsvcs%' OR lower(creatorProcessName) like '%regsvcs%' OR lower(newProcessName) like '%regasm%' OR lower(creatorProcessName) like '%regasm%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3600,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "80b76245-6a94-4bdc-8986-98cdf1f0b235",
          "name": "Execution_of_fdump",
          "kind": "augmentation",
          "lql": "`select 'LH00707' AS alert_id, 'Execution of fdump' AS alert_type, 'Defense Evasion' AS tactic, 'File System Logical Offsets' AS technique, 6.0 AS lhub_score, 2.0 AS risk_score, 3.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%fdump.exe%' OR lower(creatorProcessName) like '%fdump.exe%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3900,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "17df4a61-f5fd-4529-9bba-457aaf1e57b0",
          "name": "CMSTP_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00601' AS alert_id, 'CMSTP Technique' AS alert_type, 'Execution' AS tactic, 'CMSTP' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%cmstp%' OR lower(creatorProcessName) like '%cmstp%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 5700,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "0959d913-0f47-4c28-95e6-8d82ecde18b2",
          "name": "SDBINST_Execution",
          "kind": "augmentation",
          "lql": "`select 'LH00708' AS alert_id, 'Possible application shimming using sdbinst' AS alert_type, 'Persistence' AS tactic, 'Application Shimming' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%sdbinst.exe%' OR lower(creatorProcessName) like '%sdbinst.exe%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 4800,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "958c3a3e-7037-49f9-8bbb-62209a8a31e5",
          "name": "Executable_not_drive_c",
          "kind": "augmentation",
          "lql": "`select 'LH00719' AS alert_id, 'Executable launched from possible removable media' AS alert_type, 'Command and Control' AS tactic, 'Communication Through Removable Media' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, max(lhub_ts) AS alert_time, creatorAccountName AS src_user, TO_JSON(collect_set(newProcessName)) AS additional_data FROM Clean_data where lower(newProcessName) NOT like 'c:%' AND length(newProcessName)>1\nAND lower(newProcessName) NOT LIKE 'd:\\\\program files%'\nAND lower(newProcessName) NOT LIKE 'e:\\\\program files%'\nGROUP BY src_machine_name, creatorAccountName`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 5400,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "acf6e286-154a-4e4c-835c-3fd5d733d630",
          "name": "Execution_of_setmyparent",
          "kind": "augmentation",
          "lql": "`select 'LH00707' AS alert_id, 'Execution of setmyparent' AS alert_type, 'Privilege Execution' AS tactic, 'Parent PID Spoofing' AS technique, 6.0 AS lhub_score, 2.0 AS risk_score, 3.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%setmyparent.exe%' OR lower(creatorProcessName) like '%setmyparent.exe%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 1500,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "5740d452-4654-42c0-969b-6085d00830ef",
          "name": "Output",
          "kind": "output",
          "warnings": [],
          "description": "",
          "nodes": [
            "6691e609-917d-4754-85d8-8179b6d47d3d"
          ],
          "isExplainable": true,
          "x": 3150,
          "y": 638,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "categoryKind": "Unknown",
          "iconTitle": "Unknown",
          "usedByEventTypes": []
        },
        {
          "id": "3d096655-736f-493d-8d8e-05d3cf72ca63",
          "name": "Office_spawning_scripting_tool",
          "kind": "augmentation",
          "lql": "`select 'LH00603' AS alert_id, 'MS Office spawning child process' AS alert_type, 'Execution' AS tactic, 'Dynamic Data Exchange' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where lower(creatorProcessName) like '%office%'`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 600,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "762434ae-afca-4ad7-9f56-afe9847e487c",
          "name": "Windows_Event_4688",
          "kind": "eventType",
          "isLeaf": false,
          "eventType": "eventType-20",
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3150,
          "y": 0,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "contentItemIdentifier": {
            "kind": "EventTypeContentKind",
            "id": "eventType-20"
          },
          "categoryKind": "FetchData",
          "linkToTrigger": true,
          "iconTitle": "Fetch Data: Windows_Event_4688",
          "usedByEventTypes": []
        },
        {
          "id": "7482747f-0c53-4a83-9cc3-2f8f611e4420",
          "name": "Mshta_Technique",
          "kind": "augmentation",
          "lql": "`select 'LH00605' AS alert_id, 'Mshta Technique' AS alert_type, 'Execution' AS tactic, 'Mshta' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where (lower(newProcessName) like '%installutil%' OR lower(creatorProcessName) like '%installutil%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 3300,
          "y": 234,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "77217770-9693-4899-b4a1-4404424ffacd",
          "name": "Possible_System_Recovery_Inhibited",
          "kind": "augmentation",
          "lql": "`select 'LH00614' AS alert_id, 'Possible System Recovery Inhibited' AS alert_type, 'Impact' AS tactic, 'Inhibit System Recovery' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine)) AS additional_data FROM Clean_data where (\nlower(newProcessName) like '%vssadmin%' OR lower(creatorProcessName) like '%vssadmin%' OR\nlower(newProcessName) like '%wbadmin%' OR lower(creatorProcessName) like '%wbadmin%' OR\nlower(newProcessName) like '%bcdedit%' OR lower(creatorProcessName) like '%bcdedit%')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 2700,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        },
        {
          "id": "471fdb44-743f-4aae-8996-06454e036541",
          "name": "Possible_replication_through_removable_media",
          "kind": "augmentation",
          "lql": "`select 'LH00610' AS alert_id, 'Possible Replication Through Removable Media' AS alert_type, 'Initial Access' AS tactic, 'Replication Through Removable Media' AS technique, 1.0 AS lhub_score, 1.0 AS risk_score, 1.0 AS fidelity_score, lhub_ts AS alert_time, creatorAccountName AS src_user, _sourcehost AS src_machinename, TO_JSON(STRUCT(creatorProcessName, newProcessName, processCommandLine, creatorAccountName)) AS additional_data FROM Clean_data where lower(newProcessName) like 'c:%' AND NOT(lower(creatorProcessName) like 'c:%') AND length(creatorProcessName)>1 AND NOT(lower(creatorProcessName) like '%program files%') AND NOT(lower(newProcessName)='c:\\\\windows\\\\system32\\\\conhost.exe')`",
          "operator": "SELECT",
          "isLeaf": false,
          "warnings": [],
          "description": "",
          "isExplainable": true,
          "x": 0,
          "y": 224,
          "vertices": [],
          "isEditable": false,
          "isStepImplementable": true,
          "executionDependsOn": [],
          "outputtedNode": false,
          "formType": "LQLEditor",
          "categoryKind": "Code",
          "iconTitle": "Code: SQL",
          "usedByEventTypes": []
        }
      ],
      "oldId": "flow-1027",
      "listNames": [],
      "dependentCommands": [],
      "resourceFormatVersion": 2,
      "fileDataSeq": []
    }
  ],
  "baselines": [],
  "eventTypes": [
    {
      "id": "eventType-20",
      "data": {
        "name": "Windows_Event_4688",
        "query": "_sourcecategory = \"server/windows/events\" 4688 \"Command Line\"|parse regex field=_raw \".*New Process Name:(?<newProcessName>.*\\n)\" nodrop|parse regex field=_raw \".*Creator Process Name:(?<creatorProcessName>.*\\n)\" nodrop|parse regex field=_raw \".*Account Name:(?<creatorAccountName>.*)\" nodrop|parse regex field=_raw \".*Process Command Line:(?<processCommandLine>.*)\" nodrop\n | parse regex field=_raw \".*Creator Process ID:(?<creatorProcessID>.*\\n)\" nodrop|parse regex field=_raw \".*New Process ID:(?<newProcessID>.*\\n)\" nodrop|parse regex field=_raw \".*Computer = \\\"(?<src_machine_name>.*)\\\";\\n\" nodrop",
        "keyColumns": "newprocessname,creatorprocessname,creatoraccountname,processcommandline,creatorprocessid,newprocessid,src_machine_name",
        "connection": "connection-2",
        "connectionTypeEntities": {
          "entities": [
            {
              "connectionType": {
                "connectionType": "sumologic",
                "value": "query"
              },
              "connectionTypeDetail": {
                "query": "_sourcecategory = \"server/windows/events\" 4688 \"Command Line\"|parse regex field=_raw \".*New Process Name:(?<newProcessName>.*\\n)\" nodrop|parse regex field=_raw \".*Creator Process Name:(?<creatorProcessName>.*\\n)\" nodrop|parse regex field=_raw \".*Account Name:(?<creatorAccountName>.*)\" nodrop|parse regex field=_raw \".*Process Command Line:(?<processCommandLine>.*)\" nodrop\n | parse regex field=_raw \".*Creator Process ID:(?<creatorProcessID>.*\\n)\" nodrop|parse regex field=_raw \".*New Process ID:(?<newProcessID>.*\\n)\" nodrop|parse regex field=_raw \".*Computer = \\\"(?<src_machine_name>.*)\\\";\\n\" nodrop",
                "connection": "connection-2"
              }
            }
          ]
        },
        "defaultConnectionType": {
          "connectionType": "sumologic",
          "value": "query"
        }
      }
    }
  ],
  "connections": [
    {
      "id": "connection-2",
      "data": {
        "connectionType": "sumologic",
        "name": "SumoLogic",
        "isActive": false,
        "account": "",
        "secret": "",
        "url": "https://api.us2.sumologic.com/api/v1"
      }
    }
  ],
  "modules": [
    {
      "id": "logichub.mdr.format_alert_for_sumo",
      "name": "LogicHub MDR: Format Alert for Sumo",
      "description": "Format event output to send to a SumoLogic destination",
      "templateNodes": [
        {
          "name": "alert_output_for_sumo",
          "templateLQL": "`SELECT \n/* always include lhub_score in the final output */\nlhub_score,\n\n/* format the final JSON output */\nTO_JSON(STRUCT(\n\n/* Required/Standard fields first */\nlhub_score, alert_time,\nlh_batch_end, lh_batch_id, lh_hostname, lh_alert_id,\nalert_id, alert_type, technique, tactic, risk_score, fidelity_score,\n\n/* All other fields EXCEPT additional_data */\nattack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user,\n\n/* place additional_data last so it will be at the bottom of the JSON formatted output */\nadditional_data)) AS alert_output\nFROM validate_required_input`",
          "isOutput": true
        },
        {
          "name": "ensure_defined_fields_exist",
          "templateLQL": "ensureTableHasColumns(comment_ensure_table_has_columns, \"lhub_score, lhub_ts, alert_title, alert_time, alert_id, alert_type, technique, tactic, risk_score, fidelity_score, additional_data, attack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user\")",
          "isOutput": false
        },
        {
          "name": "final_columns",
          "templateLQL": "`SELECT \n/* Required/standard fields first */\nlh__new_score AS lhub_score,\nlh__new_ts AS lhub_ts,\nlh__new_ts AS alert_time,\nlh_batch_end, lh_batch_id, lh_hostname, lh_alert_id,\nalert_id,\n\n/* Legacy support for \"alert_title\" which is now called \"alert_type\" */\nCOALESCEEMPTY(alert_type, alert_title) AS alert_type,\n\ntechnique, tactic, risk_score, fidelity_score,\n\n/* All other supported fields */\nadditional_data, attack_chain, dest_ip, dest_machine_name, dest_machine_fqdn, dest_nt_domain, dest_port, dest_user, src_ip, src_machine_name, src_machine_fqdn, src_nt_domain, src_port, src_user\n\nFROM calculate_new_score_and_time`",
          "isOutput": false
        },
        {
          "name": "add_batch_metadata",
          "templateLQL": "addExecutionMetadata(ensure_defined_fields_exist)",
          "isOutput": false
        },
        {
          "name": "calculate_new_score_and_time",
          "templateLQL": "`SELECT \n/* If lhub_score = 0, keep it 0, otherwise use the greater of the original value or risk times fidelity */\nCASE DOUBLE(lhub_score) WHEN 0 THEN DOUBLE(lhub_score) ELSE GREATEST(risk_score * fidelity_score, DOUBLE(lhub_score)) END AS lh__new_score,\n\n/* For timestamp, look first for alert_time, then lhub_ts, then batch end time */\nCASE\n  WHEN BIGINT(alert_time) IS NOT NULL THEN BIGINT(alert_time)\n  WHEN BIGINT(lhub_ts) IS NOT NULL THEN BIGINT(lhub_ts) ELSE BIGINT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.interval_end_millis\"))\nEND AS lh__new_ts,\n\nREGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), '://(.*?)/') AS lh_hostname,\nREGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), '(batch-\\\\d+)$') AS lh_batch_id,\nBIGINT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.interval_end_millis\")) AS lh_batch_end,\n\n/* Generate a unique (mostly) event ID from the batch number + lhub_id */\nBIGINT(PRINTF('%s%s', REGEXP_EXTRACT(GET_JSON_OBJECT(lhub_execution_metadata, \"$.batch_url\"), 'batch-(\\\\d+)$'), lhub_id)) AS lh_alert_id,\n*\nFROM add_batch_metadata`",
          "isOutput": false
        },
        {
          "name": "comment_ensure_table_has_columns",
          "templateLQL": "`\n/* Since some columns are only conditionally required, there has to be a step to explicitly check for values in those fields anyway, so to keep it simple, all possible fields are protected in ensureTableHasColumns, and some are validated later to ensure that they have a value.\n\nFields supported but not part of the final JSON schema:\n- lhub_score - can be used to override final score\n- lhub_ts - when available, used to calculate alert_time\n- alert_title - legacy support, but since renamed to alert_type\n\nNot expected from input but allowed when available:\n- alert_time: calculated from lhub_ts or batch time, but if this is available then we'll accept it as truth\n\nAfter that, ALL SUPPORTED FIELDS from supported schema\nhttps://logichub.atlassian.net/wiki/spaces/CON/pages/797671425/Output+Schema+for+LogicHub+Content\n*/\n\nselect * from %%%parent0%%%`",
          "isOutput": false
        },
        {
          "name": "check_for_required_fields",
          "templateLQL": "`/*\nOnce all calculations are done, verify that all the required fields have values.\nNote that some fields allow empty strings for the time being, as long as they aren't null. This is just to allow us to transition into this new alert schema while we figure it all out.\n*/\n\nSELECT *,\nCASE\n    /* array_sort will put nulls at the end, so this is a quick way to check all required inputs at once */\n    WHEN ELEMENT_AT(ARRAY_SORT(ARRAY(alert_id, alert_type, technique, tactic, risk_score, fidelity_score)), -1) IS NULL THEN 'One or more required inputs is missing or null. Required fields: alert_id, alert_type, technique, tactic, risk_score, fidelity_score'\n    WHEN TRIM(alert_id) = '' THEN 'alert_id cannot be empty'\n    WHEN TRIM(alert_type) = '' THEN 'alert_type cannot be empty'\n    WHEN risk_score NOT IN (1, 2, 3) THEN PRINTF('Invalid value for risk_score (%s). Acceptable values are from 1 (low), 2 (medium) and 3 (high).', risk_score)\n    WHEN fidelity_score NOT IN (1, 2, 3) THEN PRINTF('Invalid value for fidelity_score (%s). Acceptable values are from 1 (low), 2 (medium) and 3 (high).', fidelity_score)\n    WHEN FLOAT(lhub_score) IS NULL THEN 'Unable to calculate lhub_score from provided columns'\n    WHEN lhub_score > 10 OR lhub_score < 0 THEN PRINTF('Invalid value for lhub_score (%s). Acceptable values are from 0-10.', lhub_score)\nEND AS error\n\nFROM final_columns`",
          "isOutput": false
        },
        {
          "name": "validate_required_input",
          "templateLQL": "forceFail(check_for_required_fields, \"error\")",
          "isOutput": false
        }
      ],
      "steps": [
        {
          "name": "Module Parameters",
          "description": "",
          "inputs": [
            {
              "id": "parent0",
              "description": "Parent node",
              "label": "Parent Node",
              "dataType": "node",
              "inputType": "columnSelect",
              "dependsOn": "",
              "columnTemplating": false
            }
          ],
          "isVariadic": false
        }
      ],
      "isPublished": true,
      "author": "chad@logichub.com",
      "categories": [],
      "isEditable": true,
      "integrations": [],
      "innerModules": [],
      "tags": [],
      "moduleVersion": {
        "majorVersion": 1,
        "minorVersion": 31,
        "patchVersion": 0,
        "contentResourceVersionBranch": "Local"
      },
      "isDataSource": "No",
      "resourceFormatVersion": 3,
      "weight": 0
    }
  ],
  "annotations": [],
  "filters": [],
  "ruleSets": [],
  "integrationInstances": [],
  "customLists": [],
  "streams": [],
  "dashboards": [],
  "images": [],
  "codeBlobs": {},
  "customListsData": {},
  "executionScripts": [],
  "userForms": [],
  "flowNodeReferences": [],
  "destinations": [],
  "fileResources": [],
  "fileDataSeq": [],
  "eventModels": [],
  "version": 1
}