Execution of a Windows Script Downloaded via a LOLBIN

sequence by process.parent.entity_id with maxspan=1m
 [process where event.type == "start" and
  (process.pe.original_file_name : ("certutil.exe", "bitsadmin.exe", "CertReq.exe", "curl.exe") or
   process.executable : "?:\\Windows\\Sys*\\OpenSSH\\sftp.exe") and
  process.command_line : ("*download*", "*transfer*", "*-decode*", "*http*", "* -o*", "* --output*")]
 [process where event.type == "start" and process.pe.original_file_name : ("wscript.exe", "mshta.exe") and
  not (process.working_directory : "E:\\*" and process.name : "cscript.exe" and process.args : ("loadpromo.vbs", "LoadMasterStocks.vbs")) and
  not (process.parent.name : "cmd.exe" and
       process.parent.args :
            ("C:\\ProgramData\\NinjaRMMAgent\\scripting\\customscript_gen_?.bat-ninjascript.bat",
             "C:\\Storage\\VisualStudioProjects\\connect_wise_script\\install_speerity.bat"))]