PowerShell Obfuscation Spawned via Microsoft Office

process where event.action == "start" and
 (process.pe.original_file_name == "PowerShell.EXE" or process.name : ("powershell.exe", "pwsh.exe")) and
 (
  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") or
  (descendant of [process where event.action == "start" and process.name : ("excel.exe", "powerpnt.exe", "winword.exe")] and
   /* Issue #263 */
   not process.parent.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe"))
  ) and
  not process.Ext.token.integrity_level_name == "system" and process.parent.executable != null and 
  process.command_line :
              ("*^*^*^*^*^*^*^*^*^*",
              "*''*''*''*",
              "*`*`*`*`*",
              "*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*{*",
              "*+*+*+*+*+*",
              "*$*$*$*$*",
              "*[char[]](*)*-join",
              "*Base64String*",
              "*[*Convert]*",
              "*.Text.Encoding*",
              "*.Compression.*",
              "*.replace(*",
              "*MemoryStream*",
              "*WriteAllBytes*",
              "* -en* *",
              "* -ec *",
              "* -e *",
              "* -ex* *",
              "* -ep *",
              "* /e *",
              "* /en* *",
              "* /ec *",
              "* /ex* *",
              "* /ep *",
              "*WebClient*",
              "*DownloadFile*",
              "*DownloadString*",
              "*BitsTransfer*",
              "*Invoke-Exp*",
              "*invoke-web*",
              "*iex*",
              "*iwr*",
              "*Reflection.Assembly*",
              "*Assembly.GetType*",
              "*.Sockets.*",
              "*PromptForCredential*",
              "*nslookup*-q=txt*",
              "*wget*http*") and
  /* Issue #263 */
  not process.parent.executable :
                 ("?:\\ProgramData\\CentraStage\\AEMAgent\\AEMAgent.exe",
                  "?:\\Windows\\System32\\svchost.exe",
                  "?:\\Windows\\System32\\CompatTelRunner.exe",
                  "?:\\Windows\\System32\\taskeng.exe") and

  not process.args : ("Get-AuthenticodeSignature*", "Write-Host") and not process.command_line : "*Get-AppxPackage*Microsoft.Office*" and
  not (process.name : "powershell.exe" and process.command_line : "*Get-CIMInstance -Class Win32_Service*" and 
       process.parent.executable : "C:\\WINDOWS\\System32\\cmd.exe" and process.parent.args : "C:\\WINDOWS\\TEMP\\nessus_*.TMP") and
  not process.command_line : "powershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -" and
  not (process.name : "powershell.exe" and process.args : "$ErrorActionPreference='silentlycontinue'; $tmp = (Get-Item -Path $env:PROGRAMFILES\\Google\\Chrome\\Application\\chrome.exe).VersionInfo.FileVersion; if ($tmp) {echo $tmp; Exit;}; $tmp = (Get-Item -Path $env:PROGRAMFILES") and
  not (process.parent.name : "cmd.exe" and process.parent.args : "chcp 65001 & powershell -NonInteractive -WindowStyle Hidden -command &") and
  not (process.args : "-NoLogo" and process.args : "\\\\*.ps1") and 
  not process.args : "$bytes=[System.Text.Encoding]::UTF8.GetBytes('*');$hash=[System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes);[BitConverter]::ToString($hash).Replace('-','').ToLower()"