Command and Scripting Interpreter from Suspicious Parent

sequence with maxspan=1m
 [process where event.action == "start" and not user.id : "S-1-5-18" and 
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and
    not process.executable : "C:\\*") or

   ((process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
     not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
     not process.executable : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*")) or

   (process.executable :
	        ("?:\\Users\\*\\AppData\\*",
	         "?:\\Users\\*\\Downloads\\*",
	         "?:\\Users\\*\\Desktop\\*",
	         "?:\\Users\\Public\\*") and not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*"))
   ) and
  not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\VsDebugConsole.exe"
  ] by process.entity_id
 [process where event.action == "start" and process.name : ("cmd.exe", "powershell.exe") and
  length(process.command_line) >= 200 and not process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and 
  not (process.args : "-InputFormat" and process.args : "-command") and 
  not process.args : "UwB0AGEAcgB0ACAAIgBoAHQAdABw*" and 
  process.command_line : ("*New-ScheduledTaskAction*", "*New-ItemProperty*", "*WScript.Shell*", "*schtasks* /create*", 
                          "*\\Start Menu\\Programs\\*", "*CurrentVersion\\Run*", "*.Invoke(*", "*MpPreference*", 
			  "*-EncodedCommand*", "*Get-Content*", "*Windows Defender*", "*powershell* -e *", "*setZeroData*", 
                          "*Get-Clipboard*", "*http* -xf *", "*dns-query?name=*")
 ] by process.parent.entity_id