Remote Thread Creation In Uncommon Target Image

Action1: actionname = "sa_create_remote_thread" AND PROCESSNAME endswith "\calc.exe,\calculator.exe,\mspaint.exe,\notepad.exe,\ping.exe,\sethc.exe,\spoolsv.exe,\wordpad.exe,\write.exe" AND (PARENTPROCESSNAME != "C:\Windows\System32\csrss.exe" AND (PARENTPROCESSNAME != "C:\Windows\System32\explorer.exe,C:\Windows\System32\OpenWith.exe" OR PROCESSNAME != "C:\Windows\System32\notepad.exe") AND (PARENTPROCESSNAME != "C:\Windows\System32\AtBroker.exe" OR PROCESSNAME != "C:\Windows\System32\Sethc.exe")) AND (STARTFUNCTION != "EtwpNotificationThread" AND PARENTPROCESSNAME notcontains "unknown process" AND (PARENTPROCESSNAME != "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe" OR STARTFUNCTION != "GetCommandLineW" OR PROCESSNAME != "C:\Windows\System32\notepad.exe,C:\Windows\System32\spoolsv.exe") AND (PARENTPROCESSNAME != "C:\Program Files\Xerox\XeroxPrintExperience\CommonFiles\XeroxPrintJobEventManagerService.exe" OR STARTFUNCTION != "LoadLibraryW" OR PROCESSNAME != "C:\Windows\System32\spoolsv.exe")) select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PARENTPROCESSNAME