✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and
  process.executable : (
    "?:\\Windows\\System32\\mmc.exe",

    /* Crowdstrike specific condition as it uses NT Object paths */
    "\\Device\\HarddiskVolume*\\Windows\\System32\\mmc.exe"
  ) and
  process.args : "*.msc" and
  not process.args : (
        "?:\\Windows\\System32\\*.msc",
        "?:\\Windows\\SysWOW64\\*.msc",
        "?:\\Program files\\*.msc",
        "?:\\Program Files (x86)\\*.msc",
        "?:\\Windows\\ADFS\\Microsoft.IdentityServer.msc"
  ) and
  not process.command_line : (
    "C:\\Windows\\system32\\mmc.exe eventvwr.msc /s",
    "mmc.exe eventvwr.msc /s",
    "\"C:\\Windows\\System32\\mmc.exe\" CompMgmt.msc*"
  )