CertUtil Used for File Download (Living off the Land)

Original query, unchanged.

let Lookback = 1h;
let AllowlistedDomains = dynamic([
  "windowsupdate.microsoft.com",
  "download.microsoft.com",
  "dl.delivery.mp.microsoft.com",
  "ctldl.windowsupdate.com"
]);
let MDE_Results =
  DeviceProcessEvents
  | where Timestamp >= ago(Lookback)
  | where FileName =~ "certutil.exe"
  | where ProcessCommandLine has_any ("-urlcache", "-verifyctl", "-decode", "-decodehex")
  | where ProcessCommandLine has_any ("http://", "https://", "ftp://")
  | where not(ProcessCommandLine has_any (AllowlistedDomains))
  | extend
      AccountName   = InitiatingProcessAccountName,
      AccountDomain = InitiatingProcessAccountDomain,
      HostName      = DeviceName,
      EventTime     = Timestamp
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName;
let SecEvent_Results =
  SecurityEvent
  | where TimeGenerated >= ago(Lookback)
  | where EventID == 4688
  | where NewProcessName endswith "\\certutil.exe"
  | where CommandLine has_any ("-urlcache", "-verifyctl", "-decode", "-decodehex")
  | where CommandLine has_any ("http://", "https://", "ftp://")
  | where not(CommandLine has_any (AllowlistedDomains))
  | extend
      AccountName   = SubjectUserName,
      AccountDomain = SubjectDomainName,
      HostName      = Computer,
      EventTime     = TimeGenerated,
      ProcessCommandLine = CommandLine,
      InitiatingProcessFileName = ParentProcessName
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName;
union MDE_Results, SecEvent_Results
| sort by EventTime desc