let SystemProcesses = dynamic(["svchost.exe", "csrss.exe", "lsass.exe", "services.exe", "smss.exe", "winlogon.exe", "taskhost.exe", "spoolsv.exe", "RuntimeBroker.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in~ (SystemProcesses)
| where isnotempty(ProcessVersionInfoOriginalFileName)
| where FileName !~ ProcessVersionInfoOriginalFileName
| project Timestamp, DeviceName, AccountName, FileName, ProcessVersionInfoOriginalFileName, FolderPath, ProcessCommandLine, SHA256
| sort by Timestamp desc