sequence by process.entity_id with maxspan=30s

[network where host.os.type == "windows" and
  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and network.protocol == "dns" and
   not dns.question.name : (
          "localhost", "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com",
          "*.windowsupdate.com", "metadata.google.internal", "dist.nuget.org",
          "artifacts.elastic.co", "*.digicert.com", "packages.chocolatey.org",
          "outlook.office365.com"
       ) and not user.id : "S-1-5-18"]
[file where host.os.type == "windows" and event.type == "creation" and
  process.name : "powershell.exe" and file.extension : ("exe", "dll", "ps1", "bat") and
  not file.name : "__PSScriptPolicy*.ps1"]