sentinelone search syntax

Hey wanted some clarification from the crowd. I was trained when searching for example someone executing blah.exe


CmdLine should cover everything whether it's under srcproccmd,tgt,parent etc..

that's not the case at times, we still need to revert to srcprocscript contains blah.exe.

what's the general rule when you guys are searching? normally we're looking for people using cmd or powershell using LOL techniques like cscript > .js

case crowd cybersecurity etc general hey people search sentinelone under