Regsvr32 with Unusual Arguments

process where event.action == "start" and process.name : "regsvr32.exe" and
 (
  (process.args_count == 2 and process.working_directory : "?:\\" and not process.working_directory : "C:\\") or
  process.command_line :
          ("*.jpg*",
           "*.png*",
           "*.gif*",
           "*.bmp*",
           "*.jpeg*",
           "*.TIFF*",
           "*.tmp*",
           "*.dat*",
           "*.pdf*",
           "*.doc*",
           "*.xls*",
           "*.ppt*",
           "*.txt*",
           "* ?:/*/*",
           "* ..\\*",
           "*DumpStack.log*",
           "*:\\Users\\Public\\*",
           "*:\\Users\\*\\Documents\\*",
           "*:\\Users\\*\\Pictures\\*",
           "*:\\Users\\*\\Music\\*",
           "*:\\Users\\*\\Pictures\\*",
           "*:\\Windows\\Tasks\\*",
           "*:\\Windows\\System32\\tasks\\*",
           "*\\DavWWWRoot\\*")
  ) and

 not process.args : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*") and

 /*  path traversal */
 not (process.command_line : "* ..\\*" and process.command_line :"* ..\\*\\*") and
 not process.parent.executable : "?:\\Program Files (x86)\\Tencent\\QQPCMgr\\*\\QQPCTray.exe" and
 not process.command_line :
             ("*\\Program Files (x86)\\Tencent\\QQPCMgr\\*.dat*",
              "*QQPCMgr*TSWebMon64.dat*",
              "*BarTender Suite\\Codejock.DockingPane.x64.v15.3.1.ocx*") and
 not process.parent.executable : "?:\\Eaglesoft\\Shared Files\\OcxReg.exe" and
 not process.args : ("?:\\windows\\system32\\ChartFX.ClientServer.Data.dll", "?:\\Windows\\SysWOW64\\ChartFX.ClientServer.Data.dll") and
 not (process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\*\\Microsoft.Teams.AddinLoader.dll" and process.args : "/i:user") and
 not (process.args : "..\\*.dll" and process.working_directory : "?:\\Program Files\\LANDesk\\ManagementSuite\\Install Only Files\\") and
 not (process.args : "..\\*.dll" and
      descendant of
       [process where event.action == "start" and
        process.executable : ("?:\\Program Files\\LANDesk\\ManagementSuite\\Install Only Files\\LaunchApp.exe",
                              "?:\\Program Files (x86)\\LANDesk\\ManagementSuite\\Install Only Files\\LaunchApp.exe")]) and
 not (process.parent.name : "msiexec.exe" and process.parent.args : "-Embedding") and
 not process.parent.executable : "C:\\Program Files\\LANDesk\\ManagementSuite\\Install Only Files\\LaunchApp.exe" and
 not (process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\SSM*.tmp\\REGSVR32.EXE" and process.args : "?:\\WINDOWS\\system32\\*.dll") and
 not process.args : ("?:\\Windows\\Microsoft.NET\\*",
                     "?:\\Windows\\assembly\\NativeImages*",
                     "?:\\Windows\\Installer\\MSI*",
                     "?:\\Windows\\system32\\Codejock.DockingPane.*.ocx",
                     "?:\\windows\\system32\\Msjet35.dll",
                     "?:\\windows\\system32\\Msrd2x35.dll",
                     "System.Data.dll", "Atalasoft.*.dll", "DTI.ImageMan.Codecs.Pdf.dll") and
 not (process.name : "regsvr32.exe" and process.parent.executable : "C:\\Windows\\SysWOW64\\cmd.exe" and
      process.args : ("C:\\Users\\*\\AppData\\Local\\Temp\\is-*.tmp\\QClickV?\\Driver\\QClickV?_x64.ocx",
                      "(x86)\\eClinicalWorks_Prod\\RegBlg.bat")) and
 process.command_line != "regsvr32  DevExpress.Data.v14.1.dll"