PowerShell Script with Passwords Vault Access Capability

api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
  process.Ext.api.parameters.buffer : "*Credentials.PasswordVault*" and process.Ext.api.parameters.buffer : ("*.RetrievePassword*", "*.RetrieveAll*") and
  not process.Ext.api.parameters.content_name : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and
  not (process.parent.executable : ("C:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe", "C:\\Users\\*\\Downloads\\keeperimport*.exe") and
       process.command_line : "C:\\WINDOWS\\system32\\windowspowershell\\v1.0\\powershell.exe \"[Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime];(new-object Windows.Security.Credentials.PasswordVault).RetrieveAll()
| % { $_.RetrievePassword(); $_ }\"")