Potential Process Doppelganging

'This query detects Process Doppelganging, a technique that calls several APIs related to NTFS transactions which allow to substitute the PE content before the process is even created. Ref: https://attack.mitre.org/techniques/T1055/013/'