Review the process creation logs on a Windows host to uncover any tool execution indicative of a special APC injection for shellcode execution. What was the name of the executable used?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine contains "inject" or ProcessCommandLine contains "shellcode" or ProcessCommandLine contains "beacon" or ProcessCommandLine contains "payload" or FileName contains "inject" or FileName contains "shellcode" or FileName contains "beacon" or FileName contains "payload"
| distinct FileName

DeviceProcessEvents
| where ActionType == 'ProcessCreated'
| where ProcessCommandLine contains 'rundll32' or ProcessCommandLine contains 'regsvr32' or ProcessCommandLine contains 'mshta' or InitiatingProcessFileName in ('rundll32.exe', 'regsvr32.exe', 'mshta.exe')
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by Timestamp desc

DeviceProcessEvents
| where ActionType == 'ProcessCreated'
| where FileName in~ ('rundll32.exe', 'regsvr32.exe', 'powershell.exe') and (ProcessCommandLine has 'dll' or ProcessCommandLine has 'http')
| project FileName, ProcessCommandLine, Timestamp
| summarize ExecutableUsed = arg_max(FileName, *) by FileName
| project ExecutableUsed

// ------------- Hunt for the "Special APC" shell-code injector -----------------
let apc_keywords = dynamic(["special_apc","specialapc","special-apc","special","queueuserapc","queue_user_apc","apcinject","apc_inject","shellcode","inject"]);
DeviceProcessEvents
| where ActionType =~ "ProcessCreated"                        // keep only process-creation events
| extend lFile = tolower(FileName),
         lCmd  = tolower(ProcessCommandLine)                   // normalise for case-insensitive keyword search
| where lFile has_any(apc_keywords) or lCmd has_any(apc_keywords)
// Return the interesting details for investigation
| project TimeGenerated, DeviceName, AccountName, FolderPath, FileName,
          ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc
// --- If you only need the name of the executable that performed the Special APC injection, uncomment the next line ---
// | distinct FileName