Library Loaded From a Potentially Altered Call Stack

library where process.executable != null and
 dll.name : ("vaultcli.dll", "wmiutils.dll", "taskschd.dll", "dnsapi.dll", "dsquery.dll",
              "mstask.dll", "mstscax.dll", "sqlite3.dll", "ws2_32.dll", "wininet.dll", "amsi.dll",
              "dnsapi.dll", "winhttp.dll", "psapi.dll", "bitsproxy.dll", "softokn3.dll",
              "System.Management.Automation.dll", "Wldap32.dll", "wtsapi32.dll") and
 process.thread.Ext.call_stack_summary like "ntdll.dll
| *" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Windows\\Sys?????\\ntdll.dll!LdrLoadDll*") and
 not stringcontains~(process.thread.Ext.call_stack_summary, process.name) and
 not process.thread.Ext.call_stack_summary like ("*Unbacked*", "*Unknown*", "*hmpalert.dll*",
                                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll",
                                                 "ntdll.dll
| wow64.dll
| ntdll.dll", "*tmmon64.dll*",
                                                 "ntdll.dll
| *wcp.dll
| cbscore.dll
| *",
                                                 "ntdll.dll
| *$$deletemekernelbase.dll*",
                                                 "ntdll.dll
| *$$deleteme.kernelbase.dll*",
                                                 "ntdll.dll
| kernelbase.dll
| combase.dll
| *",
                                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| mscoreei.dll
| *",
                                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| combase.dll
| *",
                                                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| clr.dll
| *",
                                                 "ntdll.dll
| *kernelbase.dll
| clr.dll
| *",
                                                 "ntdll.dll
| ctiuser.dll
| ntdll.dll
| kernelbase.dll
| ctiuser.dll
| *",
                                                 "ntdll.dll
| kernelbase.dll
| wsmsvc.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| advapi32.dll
| system.management.automation.ni.dll
| clr.dll
| *",
                                                 "ntdll.dll
| kernel32.dll
| kernelbase.dll
| kernel32.dll
| dwminit.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| kernelbase.dll
| fastprox.dll
| combase.dll
| rpcrt4.dll
| combase.dll
| wbemprox.dll
| *",
                                                 "ntdll.dll
| kernel32.dll
| kernelbase.dll
| kernel32.dll
| seagull_v3_configdispatcher.dll
| winspool.drv
| printisolationproxy.dll
| rpcrt4.dll
| combase.dll
| rpcrt4.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| kernelbase.dll
| netjoin.dll
| wkssvc.dll
| rpcrt4.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| kernelbase.dll
| doclient.dll
| ucrtbase.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| kernelbase.dll
| msi.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| umppc2*.dll
| ntdll.dll
| kernelbase.dll
| combase.dll
| qmgr.dll
| combase.dll
| qmgr.dll
| combase.dll
| rpcrt4.dll
| combase.dll
| rpcrt4.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll",
                                                 "ntdll.dll
| kernel32.dll
| kernelbase.dll
| kernel32.dll
| devicesoftwareinstallationclient.dll
| drvstore.dll
| devicesoftwareinstallationclient.dll
| drvstore.dll
| *",
                                                 "ntdll.dll
| kernelbase.dll
| ucrtbase.dll
| msvcp_win.dll
| coremessaging.dll
| dcomp.dll
| windows.ui.xaml.dll
| coremessaging.dll
| user32.dll
| ntdll.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("*KernelBase.dll!LoadLibrary*", "*KernelBase.dll+0x*","*ntdll.dll!TpCallbackIndependent*",
                   "*ntdll.dll!LdrAddLoadAsDataTable*", "*ntdll.dll!LdrUnloadDll*", "*ntdll.dll!LdrInitializeThunk*",
                   "*ntdll.dll!TpSimpleTryPost*", "*wcp.dll!?RtlRunPrimitiveOperationsInXmlAgainstExecutor*",
                   "*KernelBase.dll!FreeLibraryAndExitThread*", "?:\\Users\\*", "?:\\Program Files*", "?:\\ProgramData*",
                   "?:\\*\\Mount*", "\\Device\\Mup*", "D:\\*", "F:\\*", "F:\\*", "I:\\*", "?:\\Windows\\temp\\*",
                   "*ntdll.dll!LdrResolveDelayLoadedAPI*", "*KernelBase.dll!FindFirstFileExW*",
                   "*ntdll.dll!TpReleaseCleanupGroupMembers*", "*KernelBase.dll!VirtualUnlock*", "*KernelBase.dll!GetCPHashNode*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetEnvironmentVariableW+*", "C:\\Windows\\System32\\KernelBase.dll!DeviceIoControl*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetComputerName*", "C:\\Windows\\System32\\KernelBase.dll!CreateProcessInternal*",
                   "C:\\Windows\\System32\\KernelBase.dll!GetProcAddress*", "C:\\Windows\\Sys*\\ntdll.dll!LdrShutdownThread*"))