KQL_win_possible_applocker_bypass.txt

SecurityEvent | where EventID == "4688" | where CommandLine contains "\\msdt.exe" or CommandLine contains "\\installutil.exe" or CommandLine contains "\\regsvcs.exe" or CommandLine contains "\\regasm.exe" or CommandLine contains "\\regsvr32.exe" or CommandLine contains "\\msbuild.exe" or CommandLine contains "\\ieexec.exe" or CommandLine contains "\\mshta.exe"