If you rely on CommandLine in Sysmon, you may want to check this out. And I am almost certain someone did point it out before... oh well...

examples:
c:\windows\system32\calc.exe\..\notepad.exe
c:\windows\system32\calc.exe\..\..\system32\notepad.exe one more fun example

"c:\windows\system32\calc.exe/foobar /../../../system32/notepad.exe"

Just in case you are wondering, Mitre Att&ck misses and quite a bit. This is not a criticism per se -- it's a great framework and work in progress. These things will be eventually added (and sometimes corrected). T1055 misses lots of subtechniques
TA0003 misses lots of techniques
T1059.005 should be split into VBA, VBS and misinterprets VB as 'interpreted'
T1059 misses PHP, LUA, ASP, Perl, Ruby, etc.