Potential Evasion via Inline Execute Assembly

sequence by process.entity_id with maxspan=5s 
 [library where dll.name : "mscorwks.dll" and 
  process.thread.Ext.call_stack_summary : 
                   ("ntdll.dll
| kernelbase.dll
| mscoreei.dll
| Unbacked",
                    "ntdll.dll
| kernelbase.dll
| mscoreei.dll
| mscoree.dll
| Unbacked",
                    "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| mscoreei.dll
| Unbacked") and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*mscoreei.dll!CreateInterface*") and 
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and 
  not (process.executable : "?:\\Program Files\\Dell\\DTP\\DiagnosticsSubAgent\\Dell.TechHub.Diagnostics.SubAgent.exe" and
       process.code_signature.trusted == true and process.code_signature.subject_name : "Dell Inc") and
  not (process.code_signature.trusted == true and 
       process.code_signature.subject_name : ("Azul Systems, Inc.", "JetBrains s.r.o.", "Milsoft Utility Solutions, Inc.")) and 
  not (process.executable : "C:\\ManageEngine\\ADManager Plus\\jre\\bin\\java.exe" and 
      process.code_signature.subject_name : "Oracle America, Inc." and process.code_signature.trusted == true) and 
  not (process.executable : "?:\\Program Files*\\Amazon Corretto\\jdk*\\bin\\java.exe" and 
       process.code_signature.subject_name : "Amazon.com Services LLC" and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files\\Hexagon\\Cipher *\\Cipher.exe",
                            "?:\\Windows\\Microsoft.NET\\Framework64\\*\\dfsvc.exe",
                            "?:\\Program Files (x86)\\XMPie\\Circle Agent\\Service\\XMCircleAgent.exe")
  ]
 [network where network.direction == "egress" and network.transport == "tcp"]