[
  {"id":"word-shell","EventID":4688,"ParentProcessName":"C:\\Program Files\\Office\\WINWORD.EXE","NewProcessName":"C:\\Windows\\System32\\cmd.exe","CommandLine":"cmd.exe /c echo benign-fixture"},
  {"id":"ordinary-shell","EventID":4688,"ParentProcessName":"C:\\Windows\\explorer.exe","NewProcessName":"C:\\Windows\\System32\\cmd.exe"},
  {"id":"word-editor","EventID":4688,"ParentProcessName":"C:\\Office\\WINWORD.EXE","NewProcessName":"C:\\Windows\\notepad.exe"},
  {"id":"wrong-event","EventID":4624,"ParentProcessName":"C:\\Office\\WINWORD.EXE","NewProcessName":"C:\\Windows\\System32\\cmd.exe"},
  {"id":"missing-parent","EventID":4688,"NewProcessName":"C:\\Windows\\System32\\cmd.exe"},
  {"id":"name-near-match","EventID":4688,"ParentProcessName":"C:\\Office\\notwinword.exe","NewProcessName":"C:\\Windows\\System32\\cmd.exe"}
]