Potential Evasion via dotNET Framework Installation Utility

process where event.action == "start" and
 (
   ((process.name : "installutil.exe" or process.pe.original_file_name == "InstallUtil.exe") and process.command_line :  ("*/LogFile*", "*http*")) or

   descendant of [process where event.action == "start" and
                  (process.name : "installutil.exe" or process.pe.original_file_name == "InstallUtil.exe") and process.command_line :  "*/LogFile*"]
 ) and
 not (process.executable : "?:\\Windows\\System32\\conhost.exe" and process.args : "0xffffffff" and process.args : "-ForceV1") and
 not (process.name : "installutil.exe" and
      process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "PFU.PaperStream.Capture.FiScannerEventService.exe", "PFU.PaperStream.Capture.ReleaseService.exe")) and
 not (process.parent.name : "installutil.exe" and process.parent.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
 not process.executable :
              ("?:\\Program Files\\*exe",
               "?:\\Program Files (x86)\\*.exe",
               "?:\\Windows\\System32\\wbem\\mofcomp.exe",
               "?:\\Windows\\SysWOW64\\wbem\\mofcomp.exe",
               "?:\\Windows\\system32\\conhost.exe",
               "?:\\Windows\\SysWOW64\\conhost.exe",
               "?:\\Windows\\Sys*\\net.exe",
               "?:\\Windows\\Sys*\\net1.exe",
               "?:\\Windows\\System32\\wbem\\mofcomp.exe") and
 not process.parent.executable :
              ("?:\\Program Files*\\SolarWinds\\Orion\\ConfigurationWizard.exe",
               "?:\\Program Files*\\Rescue and Smart Assistant\\InstallUtil64.exe",
               "?:\\Program Files*\\Rescue and Smart Assistant\\*.exe",
               "?:\\Windows\\System32\\msiexec.exe") and
 not (process.executable : "?:\\Windows\\System32\\sc.exe" and process.args : "delete") and
 not (process.args : "/LogFile=C:\\ProgramData\\Veeam\\Setup\\Temp\\Veeam.Backup.PowerShell.InstallLog" and process.parent.name : "msiexec.exe") and
 not (process.name : "InstallUtil.exe" and process.args : ("C:\\Estensa\\Bin64Client\\SL.Server.Cache.WindowsService.exe", "\\SolarWinds TFTP Server.exe"))