Execution via Interactive Secondary Logon

sequence with maxspan=1m
 [authentication where event.action == "log_on" and process.Ext.session_info.logon_type == "Interactive" and
   process.executable : "?:\\Windows\\System32\\svchost.exe" and user.effective.id != "S-1-0-0"] by Target.process.Ext.authentication_id, user.effective.id, process.entity_id
 [process where event.action == "start" and
  process.parent.thread.Ext.call_stack_summary like "ntdll.dll
| *kernelbase.dll
| kernel32.dll
| seclogon.dll
| rpcrt4.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll" and
  not process.parent.executable : ("C:\\Windows\\System32\\runas.exe",
                                   "C:\\Program Files (x86)\\EGS\\EGS_WeighingScaleService\\runasspc.exe",
                                   "C:\\Program Files (x86)\\Historia Clinica Agente\\PsExec.exe") and
  not (process.name == "rundll32.exe" and process.args : "C:\\WINDOWS\\System32\\SHELL32.dll,RunAsNewUser_RunDLL"
       and process.parent.executable : ("C:\\Windows\\explorer.exe", "C:\\Windows\\System32\\RuntimeBroker.exe")) and
  not (process.code_signature.trusted == true and
       process.code_signature.subject_name in ("Ghisler Software GmbH", "ISL Online Ltd.", "TeamViewer GmbH", "TeamViewer Germany GmbH",
                                               "CAS Software AG", "N-ABLE TECHNOLOGIES LTD", "Bomgar Corporation", "Splashtop Inc.",
                                               "GoTo Technologies USA, LLC", "BeyondTrust Corporation", "AnyDesk Software GmbH",
                                               "SCHNEIDER ELECTRIC USA, INC.", "PURSLANE")) and
  not (process.parent.code_signature.subject_name == "Oliver Hessing" and process.parent.code_signature.trusted == true)
  ] by process.Ext.authentication_id, user.id, process.parent.Ext.real.entity_id