Scheduled Task from a Removable or Mounted ISO Device

sequence with maxspan=5m
 [process where event.action == "start" and
  (
   (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*") or

   descendant of [process where event.action == "start" and
   process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk", "USB *") and not process.executable : "C:\\*"]
   ) and
   not process.executable : ("?:\\Program Files\\Microsoft Office\\root\\Integration\\Addons\\OneDriveSetup.exe",
                             "?:\\Program Files (x86)\\Microsoft Office\\root\\Integration\\Addons\\OneDriveSetup.exe",
                             "?:\\Program Files (x86)\\AnVir Task Manager\\AnVir.exe",
                             "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe") and
   not (process.code_signature.subject_name : ("Global Security Center", "The MathWorks, Inc.") and process.code_signature.trusted == true) and
   not process.hash.sha256 : ("0069d5e4690d717377410d56b56fc543edb333eb099eb591fbe561fd36c4feea",
                              "e720b05e5bc033c8cd48be3d88bf29af9ba51eeed489d6ef23d64f8b99d5648c",
                              "98935483ec3a9d55b45a095e1dc5a98c894aec51131390c914bf6950905629ab") and
   not (process.name : "powershell.exe" and process.parent.executable : "C:\\Program Files\\Wireshark\\npcap-*.exe") and
   not (process.name : "schtasks.exe" and process.args : "Schneider Electric\\Power Monitoring Expert\\*"
        and process.args : "*C:\\Program Files (x86)\\Schneider Electric\\Power Monitoring Expert\\*") and
   not (process.executable : "?:\\Program Files\\Internet Explorer\\iexplore.exe" and process.args : "Bootstrap\\Log\\*\\SqlDiscoveryReport.htm")
 ] by process.entity_id
[file where event.action : "creation" and process.name : "svchost.exe" and
  file.path : ("?:\\Windows\\Tasks\\*", "?:\\Windows\\System32\\Tasks\\*")] by Effective_process.entity_id