✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and
 event.action == "open" and event.outcome == "success" and process.executable != null and
 file.path :
      ("?:\\Windows\\System32\\config\\RegBack\\SAM",
       "?:\\Windows\\System32\\config\\RegBack\\SECURITY",
       "?:\\Windows\\System32\\config\\RegBack\\SYSTEM") and
 not (
    user.id == "S-1-5-18" and process.executable : (
        "?:\\Windows\\system32\\taskhostw.exe",
        "?:\\Windows\\system32\\taskhost.exe",
        "?:\\Program Files\\Sophos\\Endpoint Defense\\SophosScanCoordinator.exe",
        "?:\\Program Files\\Sophos\\Endpoint Defense\\SSPService.exe",
        "?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe",
        "?:\\Program Files\\Trend Micro\\AMSP\\coreServiceShell.exe",
        "?:\\Program Files\\Symantec\\Symantec Endpoint Protection\\*\\Bin64\\ccSvcHst.exe",
        "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe",
        "?:\\Program Files\\N-able Technologies\\AVDefender\\EPSecurityService.exe",
        "?:\\Program Files\\Cylance\\Optics\\CyOptics.exe",
        "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
        "?:\\Program Files (x86)\\Padvish AV\\APCcSvc.exe"
    )
 )