DeviceProcessEvents
| where Timestamp > ago(1d)
| where ProcessCommandLine has_any ("privilege::debug", "SeDebugPrivilege", "AdjustTokenPrivileges")
| where FileName !in~ ("MsMpEng.exe", "svchost.exe", "csrss.exe", "lsass.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc