Unusual LDAP Client Process

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and
  process.executable : ("?:\\Windows\\system32\\*", "?:\\Windows\\SysWOW64\\*") and
  process.parent.name != null and
  process.code_signature.subject_name : "Microsoft *" and 
  not process.name : ("powershell.exe", "powershell_ise.exe", "pwsh.exe") and
  not process.executable : 
            ("?:\\Windows\\AdminArsenal\\PDQInventory-Scanner\\service-1\\exec\\PDQInventoryScanner.exe", 
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe", 
             "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe", 
             "?:\\Windows\\System32\\wsmprovhost.exe", 
             "?:\\Windows\\System32\\Essentials\\SharedServiceHost.exe",
             "?:\\Windows\\System32\\Essentials\\RunTask.exe",
             "?:\\Windows\\System32\\Essentials\\ProviderRegistryService.exe",
             "?:\\Windows\\System32\\mmc.exe", 
             "?:\\Windows\\SysWOW64\\mmc.exe", 
             "?:\\Windows\\System32\\ServerManager.exe", 
             "?:\\Windows\\System32\\dsac.exe", 
             "?:\\Windows\\System32\\Vmw.exe", 
             "?:\\Windows\\SysWOW64\\msiexec.exe", 
             "?:\\Windows\\System32\\msiexec.exe", 
             "?:\\Windows\\System32\\ClusterUpdateUI.exe",
             "?:\\Windows\\System32\\Essentials\\Dashboard.exe",
             "?:\\Windows\\System32\\gpresult.exe",
             "?:\\Windows\\System32\\RAMgmtUI.exe",
             "?:\\Windows\\System32\\LogonUI.exe",
             "?:\\Windows\\System32\\consent.exe",
             "?:\\Windows\\System32\\conhost.exe") and
  not (process.executable :
            ("?:\\Windows\\System32\\dllhost.exe",
             "?:\\Windows\\System32\\taskhost*.exe",
             "?:\\Windows\\SysWOW64\\dllhost.exe",
             "?:\\Windows\\SysWOW64\\taskhost*.exe") and
       process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
  not (process.name : "dllhost.exe" and process.args : "/Processid:{7F9BBC82-BA5F-4448-8622-EF76B8D007E6}") and
  not (process.name : "rundll32.exe" and
       process.command_line : "*zzzzInvokeManagedCustomActionOutOfProc*" and process.parent.name : "msiexec.exe") and
  not (process.name : ("cscript.exe", "wscript.exe") and
       process.parent.executable : "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe") and
  not (process.code_signature.subject_name : ("PDQ.com Corporation", "ci solution GmbH") and process.code_signature.trusted == true) and
  not (process.executable : "?:\\Windows\\system32\\svchost.exe" and process.args : "gpsvc" and process.parent.name : "services.exe")
  ]
 [library where dll.name : "System.DirectoryServices*.dll"]
 [network where destination.port == 389 and source.port >= 49152 and
  network.direction == "egress" and network.transport == "tcp" and
  not destination.address : ("127.*", "::1")]