process where host.os.type == "windows" and event.type == "start" and
  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and 
  not process.executable : ("?:\\Windows\\explorer.exe", 
                            "?:\\Windows\\SysWOW64\\explorer.exe",
                            "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
                            "?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
                            "?:\\Windows\\System32\\Dism.exe", 
                            "?:\\Windows\\SysWOW64\\Dism.exe",  
                            "?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
                            "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
                            "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe")