✄𐘗
text code block:
✄𐘗from logs-endpoint.events.file-*, logs-endpoint.events.registry-* metadata _id, _version, _index
| where host.os.type == "windows"
  and process.pid != 4
  and not (
    user.id == "S-1-5-18"
    and to_lower(process.executable) like """?:\\windows\\system32\\mrt.exe"""
    and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") 
    and process.code_signature.trusted == true
  )
  and (
    (
      event.category == "file"
      and event.type == "creation"
      and ends_with(to_lower(file.name), ":changelist")
    )
    or (
      event.category == "registry"
      and event.type == "change"
      and to_lower(registry.path) like """*\\system\\*controlset*\\services\\*\\args"""
      and to_lower(registry.data.strings) like "*:changelist"
    )
  )
| keep
    @timestamp,
    host.id,
    host.name,
    user.id,
    user.name,
    process.pid,
    process.name,
    process.executable,
    process.code_signature.subject_name,
    event.category,
    event.type,
    file.path,
    file.name,
    file.size,
    registry.path,
    registry.value,
    registry.data.strings,
    data_stream.namespace,
    _id,
    _version,
    _index
| limit 100