Potential Obfuscated Script Execution

sequence with maxspan=1m
 [file where event.action == "creation" and 
  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-90") and 
  process.pid != 4 and 
  file.path : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*") and 
  file.Ext.entropy >= 6 and not file.Ext.header_bytes : "4d5a*" and
  not (process.name : "ifa-PM.exe" and file.name : "ifa-PMS.hta") and
  not (process.name : "Code.exe" and file.name : "aws-lsp-codewhisperer.js") and
  not (process.name : ("Setup.exe", "vrpsetup.exe") and
      file.Ext.header_bytes : ("53657420776d6953657276696365203d", "2720436865636b206c6963206265666f")) and
  not (process.code_signature.subject_name : ("BizLink International Corp.", "Adobe Inc.", "Fabrice PARISOT", "Notepad++", "Argus Media Ltd", "Imprivata, Inc.")
       and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files (x86)\\Kovai Ltd\\BizTalk360\\Service\\BHMCollect.exe",
                            "?:\\Program Files (x86)\\BizTalkHealthMonitor\\BHMCollect.exe",
                            "?:\\Program Files\\Common Files\\Voltage Security\\VSManager2.exe",
                            "?:\\Program Files (x86)\\UPS\\CrossWare\\CrossWare.exe",
                            "?:\\Program Files\\Automation Anywhere\\Bot Agent\\jre\\bin\\javaw.exe",
                            "?:\\Program Files\\ForeScout SecureConnector\\SecureConnector.exe",
                            "?:\\Program Files (x86)\\Acronis\\BackupAndRecovery\\mms.exe",
                            "C:\\Program Files (x86)\\Delcam\\FeatureCAM\\Program\\ezfm.exe",
                            "C:\\Program Files\\IPA\\IPA.exe",
                            "?:\\Program Files\\EIZO\\ColorNavigator 7\\ColorNavigator 7.exe",
                            "?:\\Program Files (x86)\\Windev\\AD_Voyager\\AD_voyager.exe",
                            "?:\\Program Files\\BackupClient\\BackupAndRecovery\\mms.exe",
                            "?:\\Program Files\\Velneo\\vClient.exe",
                            "D:\\WINDEV\\AD_Voyager\\AD_voyager.exe",
                            "C:\\Program Files\\Java\\jre8\\bin\\java.exe",
                            "C:\\Program Files (x86)\\SofttechLLC\\FlightVector\\FlightVector.exe",
                            "?:\\Program Files\\Automation Anywhere\\Bot Agent\\jre\\bin\\BotLauncher.exe",
                            "C:\\Program Files\\Eclipse Adoptium\\jdk-*-hotspot\\bin\\java.exe",
                            "C:\\Program Files (x86)\\Imprivata\\OneSign Agent\\x64\\ISXAgent.exe",
                            "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\msedgewebview2.exe")] as event0
 [process where event.action == "start" and process.args_count >= 2 and 
  (
   (process.Ext.relative_file_creation_time <= 500 and process.pe.original_file_name : ("node.exe", "AutoIt*.exe")) or 
    (process.pe.original_file_name : ("wscript.exe", "mshta.exe") and
     event0.file.extension : ("js", "vbs", "wsh", "vbe", "jse", "hta"))
  ) and 
  stringcontains~(process.command_line, event0.file.name) and
  not (process.parent.args : "%TEMP%\\Spiceworks\\spiceworks_upload.vbs" and process.parent.name : "cmd.exe") and
  not (process.parent.name : "mshta.exe" and process.parent.args : "\\\\*\\netlogon\\ADSelfService_Enroll.hta") and
  not (process.parent.name : "cmd.exe" and
       process.parent.command_line : "C:\\WINDOWS\\SYSTEM32\\cmd.exe /c \"\"C:\\Program Files (x86)\\BluePoint Solutions\\BPAppLaunch\\ConsoleApp\\Command BPAppLaunch.bat\"\"") and
  not process.parent.executable : ("C:\\Engineer\\Airlock Digital - Allowlisting Auditor v4.1.exe",
                                   "C:\\Program Files (x86)\\Common Files\\Adobe\\Adobe Desktop Common\\HDBox\\Setup.exe")
  ]