✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.action == "start" and
  process.parent.name : ("node.exe", "Code.exe") and
  process.parent.command_line != null and
  process.parent.command_line : ("*vscode*extensions*", "*extensionHost*") and
  (
    process.name : (
      "cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "msiexec.exe",
      "curl.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe", "mshta.exe",
      "node.exe"
    ) or
	
	// recently dropped PE
    process.Ext.relative_file_creation_time <= 500
  ) and 
  not (process.name : "cmd.exe" and process.args : ("npm.cmd config get prefix", "code -v", "chcp")) and 
  not (process.name : "python.exe" and process.parent.command_line : "*ms-python.vscode-*")