[Informational] Execution of an uncommon process at an early startup stage
[Medium -> Low] Execution of an uncommon process at an early startup stage with suspicious characteristics - Modified Metadata
[Low] Execution of an uncommon process at an early startup stage by Windows system binary
[Medium -> Low] Execution of an uncommon process at an early startup stage by Windows system binary with suspicious characteristics - Modified Metadata
[Informational] Execution of an uncommon process with a local/domain user SID at an early startup stage
[Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with suspicious characteristics - Modified Metadata
[Medium -> Low] Execution of an uncommon process with a local/domain user SID at an early startup stage with a suspicious characteristics by Windows system binary - Modified Metadata
[Informational] Rare DLP rule match by user