✄𐘗
text code block:
✄𐘗from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp, 
    _id, 
    _version, 
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line