Execution via Obfuscated PowerShell Script

api where process.Ext.api.name == "AmsiScanBuffer" and
 process.name : "powershell.exe" and user.id != "S-1-5-18" and

  /* obfuscated content */
  process.Ext.api.parameters.buffer : ("*-bxor*", "*:sptth*", "*//:p##h*", "*.rEplAcE(([chAr]*", "*$pShOMe[*", "*$ShellId[*", "*$env:Public[*",
  "*$env:ComSpec[*", "*ecalper-*", "*]rahc[*", "*NoiSsErpXe-eKoVNi*", "*elbairav-*", "*ECNErEFERpESObREv$*", "*.Name[3,11,2]*",
  "*sailA-teS*", "*]rtPtnI[*", "*-ekovnI*", "*TVqQAAMAAAAEAAAA*", "*System.Management.Automation.$([cHAr]*") and

  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : "#powershellskript *") and
  not (process.Ext.api.parameters.buffer : "*-bxor*" and process.Ext.api.parameters.buffer : ("*-bxor 0xFFFF0000*", "*Ansible.Basic.AnsibleModule*")) and
  not (process.Ext.api.parameters.buffer : ("function Get-DbaProductKey*", "function Invoke-DbaDbDecryptObjec*") and process.Ext.api.parameters.buffer : "* -bxor *") and
  not (process.Ext.api.parameters.size >= 155000 and process.Ext.api.parameters.buffer : "*HSTITest_Encoded*TVqQAAMAAAAEAAAA*") and
  not (process.Ext.api.parameters.size == 38324 and
       process.command_line : "*AkAGUAeABlAGMAXwB3AHIAYQBwAHAAZQByAF8AcwB0AHIALgBTAHAAbABpAHQAKABAACgAIgBgADAAYAAwAGAAMABgADAAIgApAC*") and
  not process.Ext.api.parameters.content_name :
                    ("?:\\Program Files\\*.ps1",
                     "?:\\Program Files (x86)\\*.ps1",
                     "D:\\*", "E:\\*", "F:\\*", "I:\\*", "X:\\*",
                     "C:\\ProgramData\\NinjaRMMAgent\\scripting\\*.ps1",
                     "C:\\ProgramData\\chocolatey\\*.ps1",
                     "C:\\WINDOWS\\IMECache\\*",
                     "C:\\ProgramData\\CentraStage\\Packages\\*\\command.ps1") and
  not process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -windowstyle hidden -nologo Invoke-Expression $env:Include" and
  not process.parent.executable : ("C:\\Program Files (x86)\\ManageSoft\\Tracker\\ndtrack.exe",
                                   "C:\\Program Files (x86)\\CentraStage\\Gui.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShell.exe",
                                   "C:\\Program Files\\SentinelOne\\Sentinel Agent *\\Addons\\SentinelAddonHost.exe",
                                   "C:\\Program Files (x86)\\Spiceworks Agent Shell\\AgentShellService.exe",
                                   "C:\\Program Files\\Microsoft VS Code\\Code.exe",
                                   "C:\\Windows\\System32\\gpscript.exe",
                                   "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                                   "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                                   "C:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnectivityNetworkService.exe",
                                   "C:\\Program Files\\Axis Communications\\AXIS Camera Station\\Components\\AXIS System Health Monitoring\\AXISSystemHealthMonitoring.exe")