ADSI-Cache File Creation By Uncommon Tool

Action1: actionname = "File Created or Modified" AND ((FILENAME contains "\Local\Microsoft\Windows\SchCache" OR OBJECTNAME contains "\Local\Microsoft\Windows\SchCache") AND (FILENAME endswith ".sch" OR OBJECTNAME endswith ".sch")) AND ((PROCESSNAME notendswith ":\Program Files\Cylance\Desktop\CylanceSvc.exe,:\Windows\CCM\CcmExec.exe,:\windows\system32\dllhost.exe,:\Windows\system32\dsac.exe,:\Windows\system32\efsui.exe,:\windows\system32\mmc.exe,:\windows\system32\svchost.exe,:\Windows\System32\wbem\WmiPrvSE.exe,:\windows\system32\WindowsPowerShell\v1.0\powershell.exe" AND PROCESSNAME notcontains ":\Windows\ccmsetup\autoupgrade\ccmsetup,:\Program Files\SentinelOne\Sentinel Agent") AND ((PROCESSNAME notcontains ":\Program Files" OR PROCESSNAME notcontains "\Microsoft Office") OR PROCESSNAME notendswith "\OUTLOOK.EXE")) AND PROCESSNAME notendswith "\LANDesk\LDCLient\ldapwhoami.exe,:\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.OBJECTNAME,Action1.FILENAME,Action1.PROCESSNAME,Action1.FILETYPE,Action1.ACCESSLIST