name: Unique process id
id: 872902be-76e9-4ee7-a48a-6275fa571cf4
version: 1.0.0
condition: >
  sequence
  maxspan 1h
  by ps.uuid
  |kevt.name = 'CreateProcess' and ps.child.name
      in
  ('firefox.exe', 'chrome.exe', 'edge.exe')
  |
  |kevt.name = 'CreateFile' and file.operation = 'CREATE'
      and
  file.extension = '.exe'
  |
min-engine-version: 2.0.0
