Windows System Module Remote Hooking

api where process.Ext.api.name == "WriteProcessMemory" and process.executable != null and
  process.thread.Ext.call_stack_final_user_module.name != null and 
  process.Ext.api.behaviors == "cross-process" and process.Ext.api.summary like ("*ntdll.dll*", "*kernelbase.dll*") and
   process.thread.Ext.call_stack_summary like
             ("Unbacked", "*kernelbase.dll
| Unbacked*", "ntdll.dll
| Unknown", "*kernel32.dll
| Unbacked*", "*ntdll.dll
| Unbacked*") and 
   not stringcontains~(process.Ext.api.summary, process.name) and 
   (process.code_signature.trusted == false or process.code_signature.exists == false or process.name : "rundll32.exe") and 
   not (process.name : "rundll32.exe" and process.command_line : "\"?:\\WINDOWS\\System32\\RUNDLL32\" tsworkspace,WorkspaceStatusNotify2" and 
        process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
   not process.thread.Ext.call_stack_final_user_module.name == "kernel" and
   not process.parent.executable : ("C:\\Program Files (x86)\\Xoreax\\IncrediBuild\\BuildSystem.exe", "C:\\Program Files (x86)\\Incredibuild\\BuildSystem.exe") and
   not process.thread.Ext.call_stack_final_user_module.path like
                               ("?:\\program files\\*",
                                "?:\\program files (x86)\\*",
                                "?:\\windows\\system32\\*.dll",
                                "?:\\windows\\syswow64\\*.dll",
                                "\\program files\\*",
                                "\\program files (x86)\\*",
                                "\\windows\\system32\\*.dll",
                                "\\windows\\syswow64\\*.dll",
                                "?:\\windows\\apppatch\\appPatch64\\exploitblocker.dll",
                                "?:\\windows\\FireEye\\AppMonitorDll.dll") and
   not (process.thread.Ext.call_stack_final_user_module.protection_provenance  in ("clr.dll", "mscorwks.dll", "coreclr.dll", "teams.exe") and
      _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Corporation", ".NET"))) and
      not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher"))