✄𐘗
text code block:
✄𐘗host.os.type: "windows" and
    event.category: "process" and event.type: "start" and
    (
        process.code_signature.subject_name : (
            "Action1 Corporation" or
            "Aeroadmin LLC" or
            "AeroAdmin LLC" or
            "AmidaWare LLC" or
            "Ammyy LLC" or
            "AnyDesk Software GmbH" or
            "AOMEI International Network Limited" or
            "Atera Networks Ltd" or
            "AWERAY PTE. LTD." or
            "BeamYourScreen GmbH" or
            "Bomgar Corporation" or
            "BreakingSecurity.net" or
            "ConnectWise, Inc." or
            "ConnectWise, LLC" or
            "Connectwise, LLC" or
            "Devolutions Inc" or
            "Devolutions inc." or
            "DOMOTZ INC." or
            "DUC FABULOUS CO.,LTD" or
            "DWSNET OÜ" or
            "DWSNET srl" or
            "Electronic Team, Inc." or
            "Famatech Corp." or
            "FleetDeck Inc" or
            "GlavSoft LLC" or
            "GlavSoft LLC." or
            "GoTo Technologies USA, LLC" or
            "Hefei Pingbo Network Technology Co. Ltd" or
            "IDrive, Inc." or
            "Impero Solutions Limited" or
            "IMPERO SOLUTIONS LIMITED" or
            "Instant Housecall" or
            "ISL Online Ltd." or
            "JumpCloud Inc" or
            "Level Software, Inc." or
            "LogMeIn, Inc." or
            "LUNIXAR SAS DE CV" or
            "MMSOFT Design Ltd." or
            "Monitoring Client" or
            "MSPBytes Corp" or
            "MSPBytes, Corp." or
            "N-ABLE TECHNOLOGIES LTD" or
            "Nanosystems S.r.l." or
            "NetSupport Ltd" or
            "NetSupport Ltd." or
            "NETSUPPORT LTD." or
            "NinjaOne LLC" or
            "NinjaRMM, LLC" or
            "Open Source Developer, Huabing Zhou" or
            "Parallels International GmbH" or
            "philandro Software GmbH" or
            "Pro Softnet Corporation" or
            "PURSLANE" or
            "RealVNC" or
            "RealVNC Limited" or
            "REMOTE UTILITIES PTE. LTD." or
            "Remote Utilities LLC" or
            "Rocket Software, Inc." or
            "Rsupport Co., Ltd." or
            "SAFIB" or
            "ScreenConnect Client" or
            "Servably, Inc." or
            "Servably Inc." or
            "ShowMyPC INC" or
            "SimpleHelp Ltd" or
            "Splashtop Inc." or
            "Superops Inc." or
            "Tailscale Inc." or
            "TeamViewer" or
            "TeamViewer GmbH" or
            "TeamViewer Germany GmbH" or
            "Techinline Limited" or
            "uvnc bvba" or
            "Yakhnovets Denis Aleksandrovich IP" or
            "Zhou Huabing" or
            "ZOHO Corporation Private Limited"
        ) or

        process.name.caseless : (
            AA_v*.exe or
            "AcronisCyberProtectConnectAgent.exe" or
            "AeroAdmin.exe" or
            "AgentMon.exe" or
            "AnyDesk.exe" or
            "apc_Admin.exe" or
            "apc_host.exe" or
            "AteraAgent.exe" or
            aweray_remote*.exe or
            "AweSun.exe" or
            "B4-Service.exe" or
            "BASupSrvc.exe" or
            "bomgar-scc.exe" or
            "CagService.exe" or
            "CloudRaCmd.exe" or
            "CloudRaSd.exe" or
            "CloudRaService.exe" or
            ConnectWiseControl*.exe or
            "connectwisecontrol.client.exe" or
            "domotzagent.exe" or
            "domotz-windows-x64-10.exe" or
            "dwagsvc.exe" or
            "DWRCC.exe" or
            "dwrcs.exe" or
            "dwrcst.exe" or
            fleetdeck_commander*.exe or
            "g2aservice.exe" or
            "getscreen.exe" or
            "GoToAssistService.exe" or
            "GoToResolveProcessChecker.exe" or
            "GoToResolveRemoteControl.exe" or
            "GoToResolveService.exe" or
            "GoToResolveTerminal.exe" or
            "GoToResolveUnattended.exe" or
            "gotohttp.exe" or
            "helpwire.exe" or
            "ImmyAgent.exe" or
            "ImmyBot.Agent.Ephemeral.exe" or
            "ImmyUpdater.exe" or
            "ImperoClientSVC.exe" or
            "ImperoServerSVC.exe" or
            "ISLLight.exe" or
            "ISLLightClient.exe" or
            "jumpcloud-agent.exe" or
            "komari.exe" or
            "komari-agent.exe" or
            "level.exe" or
            "lmi_rescue.exe" or
            "lmi_rescue_srv.exe" or
            "LMIIgnition.exe" or
            "LogMeIn.exe" or
            "ltsvc.exe" or
            "ltsvcmon.exe" or
            "lttray.exe" or
            "Lunixar.exe" or
            "LunixarRemote.exe" or
            "LunixarUpdater.exe" or
            "LvAgent.exe" or
            "ManageEngine_Remote_Access_Plus.exe" or
            "MeshAgent.exe" or
            "Mikogo-Service.exe" or
            "nezha-agent.exe" or
            "NinjaRMMAgent.exe" or
            "NinjaRMMAgentPatcher.exe" or
            "ninjarmm-cli.exe" or
            "parsec.exe" or
            "PService.exe" or
            "quickassist.exe" or
            "r_server.exe" or
            "radmin.exe" or
            "radmin3.exe" or
            "rcengmgru.exe" or
            "RCClient.exe" or
            "rcmgrsvc.exe" or
            "RCService.exe" or
            "Remote Support.exe" or
            "RemoteDesktopManager.exe" or
            "Remotely_Agent.exe" or
            "Remotely_Desktop.exe" or
            "RemotePC.exe" or
            "RemotePCDesktop.exe" or
            "RemotePCService.exe" or
            "remoteview.exe" or
            "rfusclient.exe" or
            "RMM.Agent.exe" or
            "ROMServer.exe" or
            "ROMViewer.exe" or
            "RPCSuite.exe" or
            "rserver3.exe" or
            "rustdesk.exe" or
            "rutserv.exe" or
            "rutview.exe" or
            "rvagent.exe" or
            "rvagtray.exe" or
            "saazapsc.exe" or
            ScreenConnect*.exe or
            "ScreenConnect.ClientService.exe" or
            "session_win.exe" or
            "simplegatewayservice.exe" or
            "simplehelpcustomer.exe" or
            "smpcview.exe" or
            "spclink.exe" or
            "Splashtop-streamer.exe" or
            "SplashtopSOS.exe" or
            "spsrv.exe" or
            "sragent.exe" or
            "SRService.exe" or
            "srmanager.exe" or
            "srserver.exe" or
            "strwinclt.exe" or
            "Supremo.exe" or
            "SupremoService.exe" or
            "Syncro.App.Runner.exe" or
            "Syncro.Installer.exe" or
            "Syncro.Overmind.Service.exe" or
            "Syncro.Service.exe" or
            "SyncroLive.Agent.exe" or
            "SyncroLive.Agent.Runner.exe" or
            "SyncroLive.Service.exe" or
            "tacticalrmm.exe" or
            "tailscale.exe" or
            "tailscaled.exe" or
            "teamviewer.exe" or
            "teamviewer_desktop.exe" or
            "teamviewer_service.exe" or
            "TiAgent.exe" or
            "TiClientCore.exe" or
            "ToDesk_Service.exe" or
            "ToolsIQ.exe" or
            "TSClient.exe" or
            "tvn.exe" or
            "tvnserver.exe" or
            "tvnviewer.exe" or
            "twingate.exe" or
            UltraVNC*.exe or
            UltraViewer*.exe or
            "Velociraptor.exe" or
            "vncserver.exe" or
            "vncviewer.exe" or
            "winvnc.exe" or
            "winwvc.exe" or
            "ZA_Access.exe" or
            "za_connect.exe" or
            "Zaservice.exe" or
            "ZMAgent.exe" or
            "ZohoMeeting.exe" or
            "zohotray.exe" or
            "ZohoURS.exe" or
            "ZohoURSService.exe"
        )
  ) and
  not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")