EntAppSvc Incoming Netcon dcom

sequence by host.id, process.entity_id with maxspan=3s
 [process where event.type == "start" and process.name : "svchost.exe" and process.args : "appmodel"]
 [network where event.action == "connection_accepted" and
  process.name : "svchost.exe" and
  source.port >= 49152 and destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1"]