Oversized Windows Script Execution

sequence with maxspan=1m
 [file where event.action != "deletion" and

  /* windows script file size is more than 30MB */
  file.extension : ("js", "jse", "vbs", "vbe", "wsh", "hta") and file.size >= 30000000] as event0
 [process where event.action == "start" and
  (process.name : ("wscript.exe", "cscript.exe", "mshta.exe") or process.pe.original_file_name : ("cscript.exe", "wscript.exe", "mshta.exe")) and
   (
    stringcontains~(process.command_line, event0.file.name) or
    startswith~(event0.file.path, process.working_directory)
   )]