index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "1" OR deviceaction="ProcessRollup2" OR deviceaction="WmiCreateProcess" OR deviceaction="Trace Executed Process" OR deviceaction="Process" OR deviceaction="Childproc" OR deviceaction="Procstart" OR deviceaction="Process Activity: Launched") AND resourcecustomfield7 ENDS WITH "spoolsv.exe"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "11" OR deviceaction="PeFileWritten" OR deviceaction="JarFileWritten" OR deviceaction="MachOFileWritten" OR deviceaction="OoxmlFileWritten" OR deviceaction="ZipFileWritten" OR deviceaction="OleFileWritten" OR deviceaction="DmpFileWritten" OR deviceaction="PdfFileWritten" OR deviceaction="GenericFileWritten" OR deviceaction="RtfFileWritten" OR deviceaction="BZip2FileWritten" OR deviceaction="XarFileWritten" OR deviceaction="SevenZipFileWritten" OR deviceaction="TarFileWritten" OR deviceaction="DwgFileWritten" OR deviceaction="RarFileWritten" OR deviceaction="IdwFileWritten" OR deviceaction="SuspiciousEseFileWritten" OR deviceaction="Trace File Operations" OR deviceaction="filemod" OR deviceaction="file.added" OR deviceaction="File Activity: Created") AND filename STARTS WITH "C:\Windows\System32\spool\drivers\x64\"
index=activity AND rg_functionality="Endpoint Management Systems" AND (baseeventid = "7" OR deviceaction="Module Activity: Loaded")AND resourcecustomfield5 STARTS WITH "C:\Windows\System32\spool\drivers\x64\" AND resourcecustomfield5 NOT ENDS WITH "kernelbase.dll" AND resourcecustomfield5 NOT ENDS WITH "unidrv.dll"
