Binary Proxy Execution via Windows OpenSSH

process where event.action == "start" and
(
 (process.parent.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
 process.parent.args == "-o" and process.parent.command_line : ("*ProxyCommand=*", "*LocalCommand=*") and
 not process.executable : ("?:\\Windows\\system32\\conhost.exe", "?:\\Program Files\\Amazon\\AWSCLIV2\\aws.exe", "C:\\Windows\\System32\\OpenSSH\\ssh.exe")) or

 (process.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
  process.parent.name : ("explorer.exe", "python.exe", "conhost.exe") and
  process.command_line : ("*Command=*powershell*", "*schtasks*create*", "*LocalCommand=@echo off &&*",
                          "*Command=cmd /c*", "*ProxyCommand=*cmd.exe *", "*Command=\"cmd /c*", "*LocalCommand=scp*&&*", "*LocalCommand=?scp*&&*") )
)