DeviceProcessEvents

| where DeviceName matches regex @"^naming.convention.*" //scoping for our devices

| where FileName in~("powershell.exe","powershell_ise.exe", "cmd.exe") //things we do not want to see runas interacting with

    and InitiatingProcessFileName matches regex @"(?i)(runas.exe|shellrunas.exe)" //runas

| extend prefix1_SelfPrivAccountCheck = strcat("prefix1_",InitiatingProcessAccountName), prefix2_SelfPrivAccountCheck = strcat("prefix2_", InitiatingProcessAccountName) //define a variable as standard priv account behaviour

| where AccountName != prefix1_SelfPrivAccountCheck

    and AccountName != prefix2_SelfPrivAccountCheck //priv account check condition

    and InitiatingProcessCommandLine !contains @"/user:[redacted_username]" //filtering out [redacted name] 

| project Timestamp, DeviceName, FileName, FolderPath, SHA256, AccountName, AccountDomain, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessCommandLine, DeviceId, ReportId, AccountObjectId, AccountSid, InitiatingProcessAccountObjectId, InitiatingProcessAccountSid, CreatedProcessSessionId, IsProcessRemoteSession
 