Here is the syntax of EQL, please generate EQL for the given question.
Syntax in markdown:
----
# Basic Syntax

Basic queries within EQL require an event type and a matching condition.
The two are connected using the `where` keyword.

At the most basic level, an event query has the structure:

``` eql
event where condition
```

More specifically, an event query may resemble:

``` eql
process where process_name == "svchost.exe" and command_line != "* -k *"
```

## Conditions

Individual events can be matched with EQL by specifying criteria to
match the fields in the event to other fields or values. Criteria can be
combined with

Boolean operators

:   ``` eql
    and  or  not
    ```

Value comparisons

:   ``` eql
    <  <=  ==  !=  >=  >
    ```

Mathematical operations

:   ``` eql
    +  -  *  /  %
    ```

Wildcard matching

:   ``` eql
    name == "*some*glob*match*"
    name != "*some*glob*match*"
    ```

Function calls

:   ``` eql
    concat(user_domain, "\\", user_name)
    length(command_line) > 400
    add(timestamp, 300)
    ```

Method syntax for concise function calls

:   ``` eql
    command_line:length() > 400
    ```

Lookups against static or dynamic values

:   ``` eql
    user_name in ("Administrator", "SYSTEM", "NETWORK SERVICE")
    user_name not in ("Administrator", "SYSTEM", "NETWORK SERVICE")
    process_name in ("cmd.exe", parent_process_name)
    ```

## Strings

Strings are represented with single quotes `'` or double quotes `"`,
with special characters escaped by a single backslash