✄𐘗
text code block:
✄𐘗sequence by process.entity_id with maxspan=1m
[process where host.os.type == "windows" and event.type == "start" and
  (
    process.code_signature.trusted == false or
    process.code_signature.exists == false or
    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
    process.pe.original_file_name : ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
  ) and
  not (process.name : "powershell.exe" and process.parent.executable : "C:\\Windows\\System32\\CompatTelRunner.exe")
]
[library where host.os.type == "windows" and event.action == "load" and
  (dll.name : "Veeam.Backup.Common.dll" or dll.pe.original_file_name : "Veeam.Backup.Common.dll")]