ProcessRollup2 filters for process-execution events, and aid=* scopes the search to all endpoints. Matching ImageFileName against the escaped $Recycle.Bin directory identifies executables launched from that suspicious location; grouping by aid retains host-level results while collecting each file hash and path. CrowdStrike LogScale documentation uses ProcessRollup2 for process events and aid as the endpoint agent identifier.
Community Discussion