Remote Execution via File Shares

sequence with maxspan=1m
  [file where host.os.type == "windows" and event.type in ("creation", "change") and 
   process.pid == 4 and (file.extension : ("exe", "scr", "pif", "com") or file.Ext.header_bytes : "4d5a*")] by host.id, file.path
  [process where host.os.type == "windows" and event.type == "start" and
    not (
      (
        process.code_signature.trusted == true and
        process.code_signature.subject_name : (
              "Veeam Software Group GmbH",
              "Elasticsearch, Inc.",
              "PDQ.com Corporation",
              "CrowdStrike, Inc.",
              "Microsoft Windows Hardware Compatibility Publisher",
              "ZOHO Corporation Private Limited",
              "BeyondTrust Corporation", 
              "CyberArk Software Ltd.", 
              "Sophos Ltd",
              "AO Kaspersky Lab",
              "Anthropic, PBC",
              "Adobe Inc.",
              "Netwrix Corporation"
        )
      ) or
      (
        process.executable : (
          "?:\\Windows\\ccmsetup\\ccmsetup.exe",
          "?:\\Windows\\SoftwareDistribution\\Download\\Install\\*.exe",
          "?:\\Windows\\CAInvokerService.exe",
          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\OneDriveSetup.exe"
        ) and process.code_signature.trusted == true
      ) or
      (
        process.executable : "?:\\SMS_*\\srvboot.exe" and 
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation"
      )
    )
  ] by host.id, process.executable