MS-Teams RCE detection

let allowedProcs = dynamic(["teams.exe", "msedge.exe", "onenote.exe", "firefox.exe", "protocolhandler.exe", "werfault.exe", 
"OneDrive.exe", "winproj.exe", "chrome.exe", "mspub.exe", "outlook.exe", "iexplore.exe", "winword.exe", "excel.exe", "7zG.exe", 
"7zFM.exe", "AcroRd32.exe", "crashpad_handler.exe", "mspaint.exe", "notepad.exe", "PBIDesktop.exe", "Powerpnt.exe", "wermgr.exe", "visio.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName =~ "teams.exe" 
| where not(FileName in~ (allowedProcs))
| where not(FolderPath matches regex @"[C-Z]:\\Users\\(\w|[\.\-\s])+\\AppData\\Local\\Microsoft\\Teams\\Update.exe") and
        not(FolderPath matches regex @"[C-Z]:\\Users\\(\w|[\.\-\s])+\\AppData\\Local\\SquirrelTemp\\Update.exe") and 
        not(FolderPath matches regex @"[C-E]:\\ProgramData\\(\w+|[\.\-\s])\\SquirrelTemp\\Update\.exe") and //assuming ProgramData is on C, D or E
        not(FolderPath matches regex @"[C-E]:\\ProgramData\\(\w+|[\.\-\s])\\Microsoft\\Teams\\Update\.exe")//assuming ProgramData is on C, D or E
| union 
    (DeviceProcessEvents
    | where InitiatingProcessFileName == "protocolhandler.exe" and InitiatingProcessParentFileName =~ "teams.exe"
    | where FileName !in~ (allowedProcs)
)