KQL_win_mal_wceaux_dll.txt

SecurityEvent | where (EventID == "4656" or EventID == "4658" or EventID == "4660" or EventID == "4663" and ObjectName endswith "\\wceaux.dll")