Renamed Windows Automaton Script Interpreter

process where event.action == "start" and
  (
     /* renamed */
   (process.pe.original_file_name : "AutoHotkey.exe" and not process.name : ("AutoHotkey*.exe", "InternalAHK.exe")) or
   (process.pe.original_file_name : "KIX32.EXE" and not process.name : "KIX*.EXE") or 
   (process.name : "rebol-view*.exe" and process.parent.name : "msiexec.exe") or 
   (process.name : ("KIX32.EXE", "rebol-view*.exe", "AutoIt*.exe") and
     
	 /* execution from common suspicious paths */
     process.args : ("?:\\Users\\Public\\*", 
                     "?:\\ProgramData\\*", 
                     "?:\\Users\\*\\AppData\\*", 
                     "?:\\Windows\\Temp\\*",
                     "?:\\Windows\\Tasks\\*")) or 
    
	/* legit rebol script interpreter has no original file name thus adding this hash abused by mirrorblast*/
    process.hash.sha256 : "215e28f9660472b6271a9902573c9d190e4d7ccca33fcf8d6054941d52a3ab85" or 
	
	/* unusual script extension */
	(process.name : ("rebol-view*.exe", "AutoHotkey*.exe", "KIX*.EXE") and process.args_count == 2 and 
	 not process.command_line : ("*.ahk*", "*.rb*", "*.kix*", "*.scr*", "*.bms")) or 

        (process.Ext.relative_file_creation_time <= 300 and process.pe.original_file_name : "node.exe" and 
	 process.code_signature.subject_name : "Node.js Foundation" and not process.name : "node*.exe" and 
         process.executable : ("?:\\Users\\*", "?:\\ProgramData\\*")) 
   
   ) and  
   
   /* FP - chocolatey installs and runs Autohotkey from programdata */
   not (process.pe.original_file_name : "AutoHotkey*.exe" and
         process.executable : ("?:\\ProgramData\\chocolatey\\*", 
                               "?:\\Program Files\\AutoHotkey\\AutoHotkey*.exe",
                               "?:\\Program Files (x86)\\AutoHotkey\\AutoHotkey*.exe")) and
   not (process.executable : "?:\\ProgramData\\chocolatey\\lib\\autohotkey.install\\tools\\AutoHotkey_*setup.exe" and 
        process.parent.executable : "?:\\ProgramData\\chocolatey\\choco.exe") and
   not (process.pe.original_file_name == "KIX32.EXE" and process.command_line : "*\\NETLOGON\\*") and
   not (process.pe.original_file_name == "KIX32.EXE" and process.parent.command_line : "*\\netlogon\\*") and
   not (process.pe.original_file_name == "KIX32.EXE" and
        process.executable : ("C:\\kworking\\Bin\\RMMKSE.EXE", "C:\\kworking\\Bin\\RMMSSE.EXE", "?:\\ProgramData\\MSPB\\Bin\\RMMSSE.EXE")) and
   not (process.pe.original_file_name == "AutoHotkey.exe" and process.executable : "C:\\TCPU73\\Programm\\ClockTC\\ClockTC.exe" and
        process.parent.executable : "C:\\TCPU73\\TOTALCMD.EXE") and
   not process.executable :
                    ("?:\\Program Files\\AutoHotkey\\SciTE\\InternalAHK.exe",
                     "?:\\Users\\*\\AppData\\Local\\Programs\\AutoHotkey\\UX\\AutoHotkeyUX.exe",
                     "C:\\Windows\\ccmcache\\*.exe",
                     "C:\\Windows\\IMECache\\*.exe",
                     "\\Device\\Mup\\*\\kix32.exe") and
   not process.parent.executable :
                          ("?:\\Program Files\\KeePass Password Safe ?\\KeePass.exe",
                           "?:\\Program Files (x86)\\AutoIt3\\AutoIt3.exe",
                           "?:\\Program Files\\Far Manager\\Far.exe",
                           "?:\\Users\\*\\Stepwise\\Stepwise.exe",
                           "?:\\Users\\*\\AppData\\Local\\Programs\\AutoHotkey\\UX\\AutoHotkeyUX.exe",
                           "C:\\Program Files (x86)\\SofttechLLC\\FlightVector\\FlightVector.exe",
                           "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_*\\winget.exe")