KQL_win_susp_psexec.txt

SecurityEvent | where ((EventID == "5145" and ShareName matches regex "\\\.*\\IPC\$" and RelativeTargetName endswith "-stdin" or RelativeTargetName endswith "-stdout" or RelativeTargetName endswith "-stderr") and not (EventID == "5145" and ShareName matches regex "\\\.*\\IPC\$" and RelativeTargetName startswith "PSEXESVC"))