LoFP / security audits, maintenance, and network administrative scripts may trigger this alert only when parent context, child identity, command scope, service identity, and available artifact or destination evidence align to the same bounded workflow.

host.os.type: "windows" and
event.category: "process" and
event.type: "start" and
process.args:* and
process.parent.name: (
  "w3wp.exe" or
  "httpd.exe" or
  apache*.exe or
  "nginx.exe" or
  "php.exe" or
  "php-cgi.exe" or
  "php-win.exe" or
  "phpdbg.exe" or
  "php-fpm.exe" or
  tomcat*.exe or
  "ArcSOC.exe" or
  "frankenphp.exe" or
  "roadrunner.exe" or
  "unit.exe" or
  "caddy.exe" or
  "lighttpd.exe" or
  "iisexpress.exe" or
  "java.exe" or
  "UMWorkerProcess.exe" or
  "ws_TomcatService.exe"
) and
(
  process.name: (
    "cmd.exe" or
    "cscript.exe" or
    "powershell.exe" or
    "pwsh.exe" or
    "powershell_ise.exe" or
    "wmic.exe" or
    "wscript.exe" or
    "mshta.exe" or
    "rundll32.exe" or
    "regsvr32.exe" or
    "certutil.exe" or
    "bitsadmin.exe" or
    "curl.exe" or
    "wget.exe" or
    "whoami.exe" or
    "hostname.exe" or
    "ipconfig.exe" or
    "net.exe" or
    "net1.exe" or
    "nltest.exe" or
    "schtasks.exe" or
    "sc.exe" or
    "python.exe" or
    "perl.exe" or
    "reg.exe" or
    "netsh.exe" or
    "ntdsutil.exe" or
    "vssadmin.exe" or
    "wevtutil.exe" or
    "scrcons.exe" or
    "systeminfo.exe" or
    "tasklist.exe" or
    "netstat.exe" or
    "dsquery.exe" or
    "dsget.exe" or
    "netdom.exe"
  ) or
  process.name.caseless: (
    "cmd.exe" or
    "cscript.exe" or
    "powershell.exe" or
    "pwsh.exe" or
    "powershell_ise.exe" or
    "wmic.exe" or
    "wscript.exe" or
    "mshta.exe" or
    "rundll32.exe" or
    "regsvr32.exe" or
    "certutil.exe" or
    "bitsadmin.exe" or
    "curl.exe" or
    "wget.exe" or
    "whoami.exe" or
    "hostname.exe" or
    "ipconfig.exe" or
    "net.exe" or
    "net1.exe" or
    "nltest.exe" or
    "schtasks.exe" or
    "sc.exe" or
    "python.exe" or
    "perl.exe" or
    "ntdsutil.exe" or
    "vssadmin.exe" or
    "wevtutil.exe" or
    "scrcons.exe" or
    "systeminfo.exe" or
    "tasklist.exe" or
    "netstat.exe" or
    "dsquery.exe" or
    "dsget.exe" or
    "netdom.exe"
  )
) and 
  not
  (
    process.command_line : (
      "cmd.exe /c mode CON" or
      "cmd.exe /s /c \"mode CON\"" or
      "cmd.exe /c \"mode\"" or
      "cmd.exe /s /c \"tput colors 2>&1\"" or
      "cmd.exe /s /c \"stty 2> NUL\"" or
      "cmd.exe /s /c \"stty 2>&1\"" or
      "cmd.exe /c \"stty 2>&1\"" or
      "cmd.exe /s /c \"ipconfig /all 2>&1\"" or
      "cmd.exe /s /c \"echo '%os%'\"" or
      *.\\install\\awk.exe*
    ) or
    process.args : (\(git or (*artisan* and *queue\:work*) or *rmdir* or "mode CON" or ver or ls or mode or dir) or

    (process.name:cmd.exe and process.parent.args : "c:\\\\xampp\\\\htdocs\\\\open-audit\\\\index.php") or

    (process.name:cmd.exe and process.args:("/V:ON" and "--header-html")) or

    (process.parent.args :"E:/wamp64/bin/apache/apache*" and process.args:node*) or

    (process.parent.name:"php.exe" and process.name:"cmd.exe" and process.args:("/V:ON" and "/E:ON"))
  )