Execution from ZIP File via Explorer

process where event.action == "start" and
 process.parent.name : "explorer.exe" and process.parent.thread.Ext.call_stack_summary : "*zipfldr.dll*" and
  process.name : ("wscript.exe",
                  "cscript.exe",
                  "rundll32.exe",
                  "regsvr32.exe",
                  "cmstp.exe",
                  "RegAsm.exe",
                  "installutil.exe",
                  "mshta.exe",
                  "RegSvcs.exe",
                  "msbuild.exe",
                  "msxsl.exe",
                  "xwizard.exe",
                  "powershell.exe",
                  "AddInProcess.exe",
                  "AddInProcess32.exe",
                  "AddInUtil.exe",
                  "AppLaunch.exe",
                  "aspnet_compiler.exe") and
 not (process.parent.name : "explorer.exe" and process.executable : "C:\\Windows\\SysWOW64\\mshta.exe") and
 not (process.name : "rundll32.exe" and
          process.args : ("cryptext.dll,CryptExt*",
                          "ImageView_Fullscreen",
                          "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbApplication",
                          "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1"))