windows_system_running_processes.conf

{
    "platform": "windows",
    "description": "ATT&CK: T1034,T1121,T1117,T1085",
    "queries": {
    "system_running_processes": {
        "query": "select processes.pid, processes.name, users.username, processes.path, processes.cmdline from processes LEFT JOIN users ON processes.uid = users.uid WHERE processes.path != '';",
        "interval": 3600,
        "description": "List Windows System running processes. - ATT&CK T1034,T1121,T1117,T1085"
        },
    "snapshot_system_running_processes": {
        "query": "select processes.pid, processes.name, users.username, processes.path from processes LEFT JOIN users ON processes.uid = users.uid WHERE processes.path != '';",
        "interval": 28800,
        "description": "Snapshot List Windows System running processes - ATT&CK T1034,T1121,T1117,T1085",
        "snapshot": true
        }
   }
}