✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and process.command_line != null and
 process.parent.name : "velociraptor.exe" and
 process.name : ("cmd.exe", "powershell.exe", "rundll32.exe") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBMAG8AYwBhAGwARwByAG8AdQBwAE0AZQBtAGIAZQBy*") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBEAGEAdABl*" and process.command_line : "*-Format*") and
 not (process.name : "cmd.exe" and process.command_line : "*start*127.0.0.1:8889*") and
 not (process.name : "powershell.exe" and process.command_line : "*RwBlAHQALQBJAHQAZQBt*" and process.command_line : "*UgBlAGcAaQBzAHQAcgB5*" and process.command_line : "*UgB1AG4A*") and
 not (process.name : "powershell.exe" and
      process.args : ("RwBlAHQALQ*", "UgBlAG0AbwB2AGUALQBJAHQAZQBtACA*", "C:\\Program Files\\Velociraptor\\thor.db",
                      "import-module \"C:\\Program Files\\Velociraptor\\Tools\\*"))