eql hunt recent svc or task

process where event.action == "start" and 

(
 (process.parent.name : "svchost.exe" and process.parent.args : "schedule") or 
  process.parent.name : "services.exe" 
 )
 
 and 
 
 (process.Ext.relative_file_creation_time < 300 or process.Ext.relative_file_name_modify_time < 300)