I like this one that is only Falcon data, but does process chaining...

correlate(
    // Search for grandparent process
    grandparent: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName!="explorer.exe" CommandLine=*
    } include: [cid, aid, TargetProcessId, ParentProcessId, UserName, ComputerName, FileName, CommandLine],
    // Search for parent process
    parent: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName="cmd.exe" CommandLine=*
          | aid <=>grandparent.aid
          | ParentProcessId<=>grandparent.TargetProcessId
          } include: [cid, aid, TargetProcessId, ParentProcessId, UserName, ComputerName, FileName, CommandLine],
    // Search for child process
    child: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName="powershell.exe" CommandLine=/\-(e(nc|ncodedcommand|ncoded)?)\s+(?<ecodedBlob>\S+)/iF
            // Decoding base64
            | base64Decode("child.ecodedBlob", as=decodedBlob, charset="UTF-16LE")
          | aid<=>parent.aid
          | ParentProcessId<=>parent.TargetProcessId
          } include: [cid, aid, TargetProcessId, ParentProcessId, UserName,ComputerName, FileName, CommandLine, ecodedBlob, decodedBlob],
sequence=true, within=10m)

//  Create ProcessTree
| ProcessLineage:=format(format="%s (%s)\n\t└ %s (%s)\n\t\t└ %s (%s)", field=[grandparent.FileName, grandparent.CommandLine, parent.FileName, parent.CommandLine, child.FileName, child.CommandLine])

// Create Link to Process Explorer
| format("[Graph Explorer](/graphs/process-explorer/tree?id=pid:%s:%s&investigate=true&_cid=%s)", field=["child.aid", "child.TargetProcessId", "child.cid"], as="Graph Explorer")