LoFP / security audits, maintenance, and network administrative scripts may trigger this alert when run under web processes.

process where host.os.type == "windows" and event.type == "start" and
  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and
  process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe", "wscript.exe") and
  not
  (
    process.parent.name : ("php.exe", "httpd.exe") and process.name : "cmd.exe" and
    process.command_line : (
      "cmd.exe /c mode CON",
      "cmd.exe /s /c \"mode CON\"",
      "cmd.exe /c \"mode\"",
      "cmd.exe /s /c \"tput colors 2>&1\""
    )
  )