Suspicious NTDLL Image Load

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  not process.Ext.token.integrity_level_name in ("system", "low") and
  (
   process.name : ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wscript.exe", "notepad.exe", "msbuild.exe", "regasm.exe", "Installutil.exe") or

   process.executable : ("?:\\Users\\Public\\*",
                         "?:\\Windows\\SysWOW64\\explorer.exe",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\7z*\\",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
                         "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or

   (process.parent.name : ("rundll32.exe", "regsvr32.exe", "winword.exe", "excel.exe", "powerpnt.exe") and
    not process.executable : ("?:\\Program Files (x86)\\Microsoft Office\\*", "?:\\Program Files\\Microsoft Office\\*")) or

   (process.name : "powershell.exe" and (length(process.command_line) >= 100 or process.command_line : "*http*"))
  ) and
  not (process.name : ("wscript.exe", "cscript.exe") and process.args : "\\\\*\\SysVol\\*")
  ]
 [library where
  dll.path : ("?:\\Windows\\SysWOW64\\ntdll.dll", "?:\\Windows\\System32\\ntdll.dll") and
  process.thread.Ext.call_stack_summary : "?*" and 
  not process.thread.Ext.call_stack_summary : "ntdll.dll" and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.symbol_info : ("?:\\Program Files\\ESET\\ESET Security\\ebehmoni.dll*", "?:\\Program Files (x86)\\ESET\\ESET Security\\ebehmoni.dll*"))]
 [dns where dns.question.name : "*.*"]