Command Shell Activity Started via RunDLL32

process where event.type == "start" and
  process.name : ("cmd.exe", "powershell.exe") and
    process.parent.name : "rundll32.exe" and process.parent.command_line != null and
    not process.parent.command_line :
                    ("*:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL*",
                     "*zzzzInvokeManagedCustomActionOutOfProc*", 
                     "\"C:\\WINDOWS\\system32\\rundll32.exe\" C:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
    not (process.parent.args : "aepdu.dll,AePduRunUpdate" and process.args : "osloader" and process.args : "%windir%\\system32\\bcdedit") and
    not (process.parent.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
         process.name : "powershell.exe" and process.command_line : "*install*") and
    not process.parent.args : "C:\\Program Files\\NVIDIA Corporation\\*\\NVI2.DLL,ResumeAsync" and
    not (process.args : "dellpointstick://Mainpage/*" and process.parent.args : "Vxd_launch_UI") and
    not (process.parent.args : "?:\\Windows\\system32\\davclnt.dll,DavSetCookie" and process.name : "powershell.exe") and
    not process.parent.args : "AppXDeploymentExtensions.OneCore.dll,ShellRefresh" and
    not (process.args : ("launchalpsdelltouchpad://Mainpage/path2?param=start", "alpsdelltouchpadsettings://Mainpage/path2?param=start") and
         process.parent.args : "?:\\WINDOWS\\System32\\main.cpl") and
    not (process.command_line : "*REG QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography*" and
         process.parent.args : "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask") and
    not (process.args : "launchalpsdelltouchpad://Mainpage/path2?param=start" and process.parent.args : "Vxd_launch_UI") and 
    not (process.working_directory : "C:\\Program Files (x86)\\Windows Kits\\*\\Assessment and Deployment Kit\\Windows Assessment Toolkit\\Energy\\" and 
         process.args : "axecore.dll,RunJob_RunDll") and
    not process.parent.command_line :  "rundll32.exe \"C:\\Program Files (x86)\\Windows Shell\\fx_ws_main.dll\",ProcessDll s=hidedialog" and
    not (process.parent.command_line : "C:\\Windows\\system32\\rundll32.exe iernonce.dll,RunOnceExProcess" and
         process.working_directory : "C:\\Windows\\system32\\") and
    not (process.parent.command_line : "\"C:\\WINDOWS\\System32\\rundll32.exe\" C:\\WINDOWS\\Lvgic10u.dll,Execute" and
         process.command_line : "cmd /c C:\\WINDOWS\\System32\\rundll32.exe C:\\WINDOWS\\Lvgic10u.dll,ExecuteQuick")