Kibana is the web interface for exploring, querying, analyzing, and visualizing data stored in Elasticsearch. This record includes a read-only KQL hunt query for Sysmon process-creation events whose parent is an Office application; a match is a triage lead and does not establish that an event is malicious.
KQL
RESTRICTED_ACCESS_BLUR_MARKER