Windows Processes Suspicious Parent Directory

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "Image
| endswith": [
      "\\svchost.exe",
      "\\taskhost.exe",
      "\\lsm.exe",
      "\\lsass.exe",
      "\\services.exe",
      "\\lsaiso.exe",
      "\\csrss.exe",
      "\\wininit.exe",
      "\\winlogon.exe"
    ]
  },
  "filter_sys": [
    {
      "ParentImage
| endswith": [
        "\\SavService.exe",
        "\\ngen.exe"
      ]
    },
    {
      "ParentImage
| contains": [
        "\\System32\\",
        "\\SysWOW64\\"
      ]
    }
  ],
  "filter_msmpeng": {
    "ParentImage
| contains": [
      "\\Windows Defender\\",
      "\\Microsoft Security Client\\"
    ],
    "ParentImage
| endswith": "\\MsMpEng.exe"
  },
  "filter_null": [
    {
      "ParentImage": null
    },
    {
      "ParentImage": [
        "",
        "-"
      ]
    }
  ],
  "condition": "process_creation and (selection and not 1 of filter_*)"
}

False Positives

• ⚠ Some security products seem to spawn these