✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("pc-app.exe", "pc-printjob-spooler.exe") and
  (
    process.name : (
      "cmd.exe",
      "powershell.exe",
      "pwsh.exe",
      "powershell_ise.exe",
      "wscript.exe",
      "cscript.exe",
      "mshta.exe",
      "rundll32.exe",
      "regsvr32.exe",
      "bitsadmin.exe",
      "certutil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "calc.exe",
      "mspaint.exe"
    ) or
    ?process.pe.original_file_name : (
      "Cmd.Exe",
      "PowerShell.EXE",
      "pwsh.dll",
      "powershell_ise.EXE",
      "wscript.exe",
      "cscript.exe",
      "MSHTA.EXE",
      "RUNDLL32.EXE",
      "REGSVR32.EXE",
      "bitsadmin.exe",
      "CertUtil.exe",
      "curl.exe",
      "wget.exe",
      "net.exe",
      "net1.exe",
      "whoami.exe",
      "tasklist.exe",
      "ipconfig.exe",
      "nltest.exe",
      "systeminfo.exe",
      "charmap.exe",
      "CALC.EXE",
      "mspaint.exe"
    )
  )