Execution of a Windows Script Downloaded from the Internet

sequence with maxspan=5m
 [file where event.action == "creation" and
  file.Ext.windows.zone_identifier == 3 and file.origin_url : "http*" and
  file.extension in~ ("js", "jse", "vbs", "vbe", "wsh", "hta") and
  not file.origin_url like ("https://www.manageengine.com/products/*",
                            "https://*.sharepoint.com/*",
                            "https://artifacts.elastic.co/downloads/*",
                            "https://ajax.googleapis.com/ajax*",
                            "https://api.media.atlassian.com/*",
                            "https://gitlab.com/blooket/blooket-cheats/*", 
                            "https://dl.driverpack.io/test/PROD_Start_DriverPack.hta")
  ] as event0
 [process where event.action == "start" and
  (process.name in~ ("wscript.exe", "cscript.exe", "mshta.exe") or
   process.pe.original_file_name in ("cscript.exe", "wscript.exe", "MSHTA.EXE")) and
   (
    /* substring used to remove Zone.Identifier from file.name */
    stringcontains~(process.command_line, substring(event0.file.name, 0, length(event0.file.name) - 16)) or

    stringcontains~(process.command_line, event0.file.name) or

    startswith~(event0.file.path, process.working_directory)
   )]