.NET COM object created in non-standard Windows Script Interpreter

api where
  not process.name : ("cscript.exe", "wscript.exe") and
  process.code_signature.trusted == true and
  process.code_signature.subject_name like "Microsoft*" and
  process.Ext.api.name == "VirtualAlloc" and
  process.Ext.api.parameters.allocation_type == "RESERVE" and
  process.Ext.api.parameters.protection == "RWX" and
  process.thread.Ext.call_stack_summary like (
    /* .NET is allocating executable memory on behalf of a WSH script engine
     * Note - this covers both .NET 2 and .NET 4 framework variants */
    "*
| mscoree.dll
| combase.dll
| jscript.dll
| *",
    "*
| mscoree.dll
| combase.dll
| vbscript.dll
| *",
    /* These aren't WSH script engines - but the technique is likely still valid */
    "*
| mscoree.dll
| combase.dll
| jscript9.dll
| *",
    "*
| mscoree.dll
| combase.dll
| chakra.dll
| *"
) and

process.parent.executable != null and

not (process.executable : "?:\\Windows\\SysWOW64\\msiexec.exe" and 
     process.parent.executable : "?:\\Windows\\System32\\msiexec.exe" and 
     process.thread.Ext.call_stack_summary like "*
| mscoree.dll
| combase.dll
| vbscript.dll
| *
| rpcrt4.dll
| *") and

not (process.name : "mshta.exe" and 
     process.parent.executable : ("?:\\Program Files (x86)\\Amazon\\Amazon Assistant\\amazonAssistantService.exe", 
                                  "?:\\Program Files\\Microsoft Configuration Manager\\AdminConsole\\bin\\Microsoft.ConfigurationManagement.exe",
                                  "?:\\Program Files\\Bentley\\*.exe")) and 

not (process.executable : "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe" and 
     process.parent.executable : "?:\\Program Files\\Internet Explorer\\iexplore.exe" and
     process.thread.Ext.call_stack_summary like "*
| combase.dll
| jscript9.dll
| *") and

/* ASP VBScript (System32 + SysWOW64 w3wp) */
not (process.Ext.api.name == "VirtualAlloc" and 
     process.executable : ("?:\\Windows\\System32\\inetsrv\\w3wp.exe", "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe") and
     process.thread.Ext.call_stack_summary like "*
| mscoree.dll
| combase.dll
| vbscript.dll
| asp.dll
| comsvcs.dll
| *") and

/* JumpCloud */
not (process.executable : "?:\\Windows\\System32\\LogonUI.exe" and
     process.thread.Ext.call_stack_summary like "*
| vbscript.dll
| *" and
     not process.thread.Ext.call_stack_summary like "*Unbacked*") and

not (process.command_line : "\"mshta.exe\" \"C:\\Program Files (x86)\\Amazon\\Amazon Assistant\\aa.hta\"" and
    process.parent.executable : "C:\\Program Files (x86)\\Amazon\\Amazon Assistant\\amazonAssistantService.exe") and

not (process.executable : "?:\\Program Files\\Microsoft SQL Server\\*\\DTS\\Binn\\DTExec.exe" and
     process.parent.executable : "?:\\Program Files\\Microsoft SQL Server\\*\\MSSQL\\Binn\\SQLAGENT.EXE") and

not (process.executable : "C:\\Program Files\\Microsoft Office\\root\\Office??\\OUTLOOK.EXE" and
     process.thread.Ext.call_stack_summary like "*combase.dll
| vbscript.dll
| mso30win32client.dll*") and
not (process.executable : "C:\\Windows\\System32\\CredentialUIBroker.exe" and
     process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
     process.thread.Ext.call_stack_summary == "ntdll.dll
| kernelbase.dll
| clr.dll
| mscoreei.dll
| mscoree.dll
| combase.dll
| jscript.dll
| kernel32.dll
| ntdll.dll") and
not (process.executable : "C:\\Windows\\System32\\SearchFilterHost.exe" and process.parent.executable : "C:\\Windows\\System32\\SearchIndexer.exe" and
     process.thread.Ext.call_stack_summary : "ntdll.dll*
| kernelbase.dll
| clr.dll
| mscoreei.dll
| mscoree.dll
| combase.dll
| *
| offfiltx.dll
| *
| rpcrt4.dll
| combase.dll
| rpcrt4.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll")