(#event_simpleName = ProcessRollup2 AND ImageFileName = /.*\\powershell\.exe/) OR (#event_simpleName=DnsRequest AND (DomainName!="ocsp.digicert.com" AND DomainName!="localhost"))

| rename("ContextProcessId",as="TargetProcessId")
| groupby([aid, TargetProcessId], function=stats([count(#event_simpleName, distinct=true), collect(DomainName), collect(ImageFileName), collect(CommandLine)]), limit=max)
| _count > 1
| ImageFileName=/.*\\(?<fileName>.*\.exe)/
| "Process Explorer" := format("[Process Explorer](https://falcon.crowdstrike.com/investigate/process-explorer/%s/%s)", field=[aid, TargetProcessId])
| table([aid, DomainName, fileName, CommandLine, "Process Explorer"])