KQL Search

This KQL (Kusto Query Language) query is searching through the DeviceImageLoadEvents table for specific events. Here's a simple summary:

1. It looks for events where the initiating process's file name contains "svchost.exe".
2. It also checks that the file name involved in the event contains "regsvc.dll".
3. Additionally, it filters out any events where the command line used to start the initiating process is exactly "svchost.exe -k LocalService".

In essence, the query is identifying instances where "svchost.exe" is involved in loading "regsvc.dll", but not when "svchost.exe" is running with the command line "svchost.exe -k LocalService".