Potential Execution via Sliver Framework

process where event.action == "start" and

(
  /* Silver default shell cmd */
 (process.name : "powershell.exe" and
  process.command_line : "?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8") or

 (process.parent.name : "powershell.exe" and
  process.parent.command_line : "?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8") or

  descendant of [process where event.action == "start" and
                 process.name : "powershell.exe" and
                 process.command_line : "?:\\Windows\\System32\\WindowsPowerShell\\*\\powershell.exe -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"] or

   /* getsystem default to injecting spoolsv.exe and for diverse cmds default to spawn a notepad.exe instance */
  (process.executable : "?:\\Windows\\System32\\notepad.exe" and process.parent.executable : "?:\\Windows\\system32\\spoolsv.exe") or

   /* Silver spawns_as a child process with extra quotes after the process image */
  (process.args_count == 2 and process.command_line : "?:\\*.exe \"\"" and process.args : "?:\\Windows\\*.exe")
) and
not (process.code_signature.subject_name : "Chocolatey Software, Inc." and process.code_signature.trusted == true) and
not (process.parent.executable : "?:\\ProgramData\\chocolatey\\choco.exe" and process.parent.args : "install") and
not  descendant of [process where event.action == "start" and
                    process.code_signature.subject_name : "Chocolatey Software, Inc." and process.code_signature.trusted == true] and
not (process.executable : "?:\\Windows\\System32\\setx.exe" and
      process.args : "ChocolateyLastPathUpdate" and process.parent.name : "powershell.exe") and 
not process.parent.executable : "?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\protocolhandler.exe"