[WINDOWS-SECURITY] OneNote executing CMD

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] OneNote executing CMD"; program:*Sysmon*
| *Security*; event_id:1,4688; content:"cmd.exe"; nocase; content:"onenote.exe"; nocase; reference:url,app.any.run/tasks/c168327f-a217-4b91-b596-55cf5ac9ffef/; classtype:trojan-activity; sid:5013841; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0005, mitre_technique_id T1211;)