Suspicious Suspended Process Creation

process where event.action == "start" and

 process.Ext.created_suspended == true and process.parent.executable != null and

 process.parent.thread.Ext.call_stack_contains_unbacked == true and

 process.parent.thread.Ext.call_stack_summary : ("*ntdll.dll
| kernelbase.dll
| Unbacked*", "*kernel32.dll
| Unbacked*", "ntdll.dll
| Unbacked*") and

 (process.parent.code_signature.status != "trusted" or process.parent.name : "rundll32.exe") and
 (
  /* process starts a signed MS binary in suspended state */
  process.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation") or

  /* process starts a suspended instance of itself */
  (startswith~(process.executable, process.parent.executable) and
   (
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or
    process.Ext.relative_file_creation_time <= 500)
    )
    and not process.parent.thread.Ext.call_stack_summary : "*system.ni.dll
| Unbacked*"
  ) and

  not (process.name : "rundll32.exe" and process.args :  "C:\\Program Files\\Rapid7\\Insight Agent\\components\\armor\\common\\Armor\\mvarmor32.dll,#1") and

  not process.parent.executable :
              ("?:\\Program Files\\rs2\\rs2Client\\rs2ClientService.exe",
               "?:\\Program Files (x86)\\Steam\\steamapps\\common\\*.exe",
               "?:\\Program Files (x86)\\MEDITECH\\EIH.Universe\\EIH.LIVEF.Ring\\System\\Magic.exe",
               "?:\\SWATCUP-Premium\\SwatCup.exe") and
  not (process.command_line : "rundll32.exe \"C:\\Program Files\\Rapid7\\Insight Agent\\components\\armor\\common\\Armor\\mvarmor32.dll\",#1" and
    process.parent.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| mvarmor64dynamic.dll
| kernel32.dll
| Unbacked") and
  not process.executable : ("?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe",
                            "?:\\Program Files\\Microsoft Visual Studio\\*.exe",
                            "?:\\Program Files (x86)\\Windows Kits\\*\\x64\\rc.exe") and
  not (process.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and
       process.parent.executable : "C:\\Windows\\SysWOW64\\rundll32.exe" and process.parent.args == "--enable-speech-input") and
  not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\ProgramData\\CentraStage*\\AEMAgent\\RMM.AdvancedSoftwareManagement\\*\\smclient\\SmClient.exe") and
  not _arraysearch(process.parent.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes :
                            ("8945d08b45d08945f4837df400741a8b45fc8b80*",
                             "8944246c8b44246c89442460488b8424b0050000*",
                             "488b5560c6420c01*", 
                             "488b9588000000c6420c01833d*", 
                             "488b9580000000c6420c01*",
                             "*85f60f95c10fb6c9898d940000004883bdd8000000007420*",
                             "*85ff0f95c00fb6c0488b9540ffffff488956104881c4e80000005b5e5f415c415d415e415f5d*", 
                             "c22c0090b8c4000000bac06c8077ffd2*", 
                             "8945e48b55f48b45e48942088b4df88b5130ffd2*",
                             "c6430c01833d*33c085f60f95c00fb6c0488b8d38ffffff48894b104881c4f80000005b5e5f415c415d415e41",
                             "c22000cccccccccccccccccccccccccccc8b4c2424518b4c2424528b542424518b4c2424528b542424518b4c2424528b542424518b4c2424528b542424518b48"))