Hunt for LPE via printnightmare

sequence by host.hostname with maxspan=1m
  [network where network.direction : ("egress", "outgoing") and 
   process.name != "spoolsv.exe" and not network.protocol == "dns" and not user.name : "SYSTEM" and
   source.port >= 49152 and destination.port >= 49152] by destination.address,source.address, destination.port, source.port
  [network where process.name : "spoolsv.exe" and user.name : "SYSTEM" and
   network.direction : ("ingress", "incoming") and
   not network.protocol == "dns" and
   source.port >= 49152 and destination.port >= 49152] by source.address, destination.address, destination.port, source.port