Powershell Execution via Named Pipe

api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
  process.Ext.api.parameters.buffer : ("*Pipes.NamedPipeClientStream*.Connect(*", "*Pipes.NamedPipeServerStream*WaitForConnection*") and
  process.Ext.api.parameters.buffer : "*.StreamReader*" and process.Ext.api.parameters.buffer : "*.StreamWriter*" and
  process.Ext.api.parameters.buffer : "*.ReadLine*" and process.Ext.api.parameters.buffer : "*.WriteLine*" and
  process.Ext.api.parameters.buffer : ("*while(*", "*while (*") and
  not (process.command_line : "*AZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAFAAaQBwAGUAcwAuAE4AYQBtAGUAZABQAGkAcABlAFMAZQByAHYAZQByAFMAdAByAGUAYQBtACgAJwBpAG4AcwBwA*" and
       process.Ext.api.parameters.size == 3354) and
  not (process.parent.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\SysWOW64\\msiexec.exe") and
       process.Ext.api.parameters.content_name : "?:\\WINDOWS\\SystemTemp\\ps*.ps1" and user.id == "S-1-5-18")