CyberArkEPM - Uncommon Windows process started from System folder

Original query, unchanged.

let lb_period = 14d;
let q_time = 1h;
let sys_proc = CyberArkEPM
| where TimeGenerated between (ago(lb_period) .. ago(q_time))
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has @'\'
| where ActingProcessName has_any ('System32', 'SysWOW64')
| summarize makeset(ActingProcessFileInternalName);
CyberArkEPM
| where TimeGenerated > ago(q_time)
| where EventSubType != 'AttackAttempt'
| where ActingProcessName has @'\'
| where ActingProcessName has_any ('System32', 'SysWOW64')
| where ActingProcessFileInternalName !in (sys_proc)
| extend AccountCustomEntity = ActorUsername