Process Creation via ROP Gadgets

process where event.action == "start" and
 not process.Ext.token.integrity_level_name == "low" and
 process.parent.thread.Ext.call_stack_summary : ("ntdll.dll
| *", "win32u.dll
| *") and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info:
                                                                 ("*ntdll.dll!*CreateUserProcess*",
                                                                  "*ntdll.dll!*DeviceIoControlFile*",
                                                                  "*ntdll.dll!*CreateThreadEx*",
                                                                  "*ntdll.dll!*AssignProcessToJobObject*",
                                                                  "*ntdll.dll!*DeleteAtom*",
                                                                  "*ntdll.dll!NtSetEvent*",
                                                                  "*ntdll.dll!NtCallbackReturn*",
                                                                  "*KernelBase.dll*!CreateProcess*",
                                                                  "*ntdll.dll+*",
                                                                  "*ntdll.dll!*ReadFile*",
                                                                  "*ntdll.dll!NtReplyWaitReceivePort*",
                                                                  "*KernelBase.dll!WriteConsoleW*", 
                                                                  "*ntdll.dll!NtDebugContinue*", 
                                                                  "*kernel32.dll!CreateProcess*", 
                                                                  "*ntdll.dll!ZwCreateMailslotFile*", 
                                                                  "*ntdll.dll!*EnableLastKnownGood*", 
                                                                  "*ntdll.dll!*CreateEnclave*", 
                                                                  "*ntdll.dll!ZwCreateTimer*",
                                                                  "*ntdll.dll!ZwCreateKeyedEvent*",
                                                                  "*ntdll.dll!NtSinglePhaseReject*",
                                                                  "*ntdll.dll!RtlCompleteProcessCloning*",
                                                                  "*ntdll.dll!NtCreateWaitCompletionPacket*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtAlpcDeleteSecurityContext+*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreateRegistryTransaction*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtCreatePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtDeletePrivateNamespace*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationDebugObject*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtQueryAttributesFile*",
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtOpenPrivateNamespace*",
                                                                  "C:\\Windows\\System32\\kernel32.dll!LoadLibrary*",
                                                                  "C:\\Windows\\System32\\KernelBase.dll!LoadLibrary*", 
                                                                  "C:\\Windows\\System32\\advapi32.dll!CreateProcessAsUser*", 
                                                                  "C:\\Windows\\System32\\wersvc.dll!SvchostPushServiceGlobals*", 
                                                                  "C:\\Windows\\System32\\ntdll.dll!NtSetInformationSymbolicLink*")) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll*" and $entry.allocation_private_bytes > 0) and
 not _arraysearch(process.parent.thread.Ext.call_stack, $entry, $entry.symbol_info : "*ntdll.dll+0x*") and
 not process.executable : ("?:\\Windows\\System32\\conhost.exe", "?:\\Windows\\SysWOW64\\WerFault.exe") and
 not (process.executable : "?:\\Windows\\System32\\sppsvc.exe" and process.Ext.protection == "PsProtectedSignerWindows" and 
      process.parent.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| kernel32.dll
| services.exe
| rpcrt4.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll")