✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and process.executable : "C:\\*" and
  (
    process.working_directory : ("D:\\*", "E:\\*", "F:\\*") or
    ?process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk")
  ) and
  process.parent.name : "explorer.exe" and
  process.name : (
    "rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe", "cscript.exe",
    "wscript.exe", "certutil.exe", "bitsadmin.exe", "msiexec.exe", "wmic.exe", "schtasks.exe", "msbuild.exe"
  )