SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time, LOGSOURCENAME(logsourceid) AS log_source, sourceip, username, "Process Name", "Process CommandLine"
FROM events
WHERE "Process CommandLine" ILIKE '%set-mppreference%' AND ("Process CommandLine" ILIKE '%disablerealtimemonitoring%' OR "Process CommandLine" ILIKE '%disablebehaviormonitoring%' OR "Process CommandLine" ILIKE '%disableioavprotection%' OR "Process CommandLine" ILIKE '%disablescriptscanning%')
LAST 7 DAYS