PowerShell Engine Loaded via Injection

sequence by process.entity_id with maxspan=1m
 [process where event.action == "start" and 
  process.executable : "C:\\*" and 
  not process.Ext.token.integrity_level_name : "low" and 
  not process.executable : 
               ("?:\\Windows\\System32\\WindowsPowerShell\\*.exe", 
                "?:\\Windows\\SysWOW64\\WindowsPowerShell\\*.exe", 
                "?:\\Program Files\\*.exe", 
                "?:\\Program Files (x86)\\*.exe") and 
  not (process.code_signature.status : "trusted" and 
       process.pe.original_file_name : ("LegacyVSTSPowerShellHost.exe", "SqlIaaSExtensionDeployer.exe", "wacrun.exe")) and 
  not process.hash.sha256 :
                   ("07bc2c53c47cf691b8836af4e377990324e612df16de63644c8c3750e9a75a57",
                    "8b66483519a4be8e2cd4b9686ea465e2171731a7a91f623069046450f22b7a39",
                    "2232525e0e8ba5d5877198fbe3589cc8a90b03054ee69e7f7d7c37761a88741f") and
  not process.pe.imphash in ("d41d8cd98f00b204e9800998ecf8427e", "45e4653ae633e067079dd72666b0158b") and
  not (process.code_signature.status : "trusted" and 
       process.code_signature.subject_name : 
            ("Citrix Systems, Inc.", "Veeam Software Group GmbH", "ScriptRunner Software GmbH", "Microsoft 3rd Party Application Component", 
             "Atera Networks Ltd", "Chocolatey Software, Inc.", "Chocolatey Software, Inc", "Datto Inc", "Datto, LLC", "Dell Technologies Inc.",
             "Syxsense Inc.")) and
  not (process.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\mscorsvw.exe" and
       process.parent.executable : "?:\\Windows\\Microsoft.NET\\Framework64\\*\\ngen.exe") and
  process.parent.thread.Ext.call_stack_summary : 
                    ("ntdll.dll
| Unbacked", 
                     "ntdll.dll
| kernelbase.dll
| Unbacked",
                     "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
                     "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                     "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll") and 
   not _arraysearch(process.parent.thread.Ext.call_stack, $entry, 
                    $entry.callsite_trailing_bytes : ("488b556*c6420c01833d*", "48894550488b4d18488b455048894110488b4528ff5040*"))]
 [library where dll.name : ("System.Management.Automation.ni.dll", "System.Management.Automation.dll")]