Execution via Suspicious JavaScript Updates

process where event.action == "start" and
 process.pe.original_file_name in ("cscript.exe", "wscript.exe") and
 (
  process.args :
        (
         /* Temp archive file */
         "?:\\Users\\*\\AppData\\Local\\Temp\\7z*\\*.Update.*.js",
         "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*.Update.*.js",
         "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*.Update.*.js",
         "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*",

         /* extracted by victim user to a random folder */
         "?:\\Users\\*\\chrome.update.*.js",
         "?:\\Users\\*\\firefox.update.*.js",
         "?:\\Users\\*\\Opera.update.*.js",
         "?:\\Users\\*\\Firefox.js",
         "?:\\Users\\*\\Chrome.js",
         "?:\\Users\\*\\Edge.js",
         "?:\\Users\\*\\Opera.js"
         ) or

  /* execution from mounted ISO or IMG  */
   (process.args regex~ """[D-Z]:\\[a-z0-9]+\.Update\.[a-z0-9]+\.js""" and process.working_directory : "?:\\" )
  )