Execution via Obfuscated Windows Script

api where process.Ext.api.name == "AmsiScanBuffer" and process.executable != null and
  process.name in~ ("wscript.exe", "mshta.exe") and
  process.Ext.api.parameters.buffer :
                    ("*var _0x*;var _0x*;var _0x*",
                     "*function*_0x*_0x*_0x*",
                     "*new ActiveXObject(_0x*",
                     "*function*.apply(this,arguments)*",
                     "*function _0x*",
                     "*function*.charCodeAt(*.charCodeAt(*",
                     "*function*.split(*.split(*.split(*",
                     "function *.fromCharCode*",
                     "*String.fromCharCode(*eval(*",
                     "*String.fromCharCode(*String.fromCharCode(*",
                     "*String.fromCharCode(*.replace(*",
                     "*var *=this[*+*+*+*var *=this[*+*+*+*var *=this[*+*+*",
                     "*function*.charCodeAt(*.charCodeAt(*.charCodeAt(*",
                     "*{return eval(Ox$(*{return eval(Ox$(*{return eval(Ox$(*",
                     "*function *String.fromCharCode(*.Run(*",
                     "*String.fromCharCode(*+*+*+*+*+*+*+*+*",
                     "*.charAt(*.charAt(*.charAt(*.charAt(*.charAt(*.charAt(*.charAt(*",
                     "*this[*+*+*+*+*+*+*]*",
                     "*TVqQAAMAAAAEAAAA*",
                     "*\\x??\\x??\\x??\\x??\\x??\\x??\\x??\\x??\\*",
                     "*bin.base64*",
                     "*replace(split*",
                     "*Chr(*Chr(*Chr(*",
                     "*Replace(Replace(*") and
  not process.Ext.api.parameters.content_name :
                              ("?:\\Program Files\\*",
                               "?:\\Program Files (x86)\\*",
                               "D:\\program\\xml_fetch_Cavagent.vbs") and
  not (process.name : "cscript.exe" and  process.Ext.api.parameters.content_name : "C:\\WINDOWS\\TEMP\\.eset-*\\uacinstall.vbs") and 
  not process.executable :
                   ("C:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe",
                    "C:\\Program Files\\Xerox\\XeroxPrintExperience\\XeroxPrintExperience\\XeroxPrintExperience.Exe") and
  not (process.code_signature.trusted == true and process.code_signature.subject_name in ("Altium LLC", "Lansweeper NV", "SAP SE", "Tyler Technologies, Inc.")) and
  not (process.Ext.api.parameters.buffer : "*kkotari: pyenv-lib.vbs proxy*" and
       process.Ext.api.parameters.content_name : "C:\\Users\\*\\.pyenv\\pyenv-win\\libexec\\pyenv.vbs") and 
  not process.parent.executable :
                     ("C:\\Program Files (x86)\\checkmk\\service\\check_mk_agent.exe",
                      "C:\\Windows\\_ScriptingFramework\\Modul\\Engine.exe", 
                      "C:\\Program Files (x86)\\Bentley\\MicroStation V8i (SELECTseries)\\MicroStation\\ustation.exe", 
                      "C:\\Program Files\\Bentley\\*.exe",
                      "C:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe",
                      "C:\\Program Files\\Bentley\\Engineering\\STAAD.Pro *\\STAAD\\Bentley.Staad.exe",
                      "C:\\Program Files (x86)\\Bentley\\MapStandalone V8i\\MapStandalone\\MapStandalone.exe",
                      "C:\\Program Files\\Common Files\\Bentley Shared\\CONNECTION Client\\Bentley.Connect.Client.exe",
                      "C:\\Program Files (x86)\\Bentley\\PowerInRoads V8i\\PowerInRoads\\PowerInRoads.exe")