Script File Written by Microsoft Office Process

sequence by user.id with maxspan=1m
 [file where event.action != "deletion" and

  /* script dropped by MS Office program */
   file.extension : ("hta", "vbs", "js", "wsf", "vbe", "jse", "ps1", "bat", "cmd", "sct") and
   process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe", "msaccess.exe")]
 [process where event.action == "start" and
  process.name : ("cscript.exe", "wscript.exe", "mshta.exe", "powershell.exe", "cmd.exe", "regsvr32.exe", "cmstp.exe", "wmic.exe") and not

 /*  descendant of MS office but not a direct child - already covered by ruleId c34a9dca-66cf-4283-944d-1800b28ae690 */
  process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe",
                         "msaccess.exe", "WmiPrvse.exe", "explorer.exe") and
  descendant of [process where event.action == "start" and
     process.name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe", "fltldr.exe", "mspub.exe", "msaccess.exe")] and
  not (process.name : "cmd.exe" and process.parent.executable : "\\Device\\Mup\\*\\netlogon\\*") and
  not (process.name : "cmd.exe" and process.parent.name : ("chrome.exe", "msedge.exe", "iexplore.exe", "opera.exe", "firefox.exe", "brave.exe")) and
  not (process.command_line : "cmd.exe /c set" and process.parent.executable : "?:\\Program Files (x86)\\eparakstitajs?\\eparakstitajs?.exe") and
  not (process.name : "regsvr32.exe" and process.args : "?:\\Program Files\\Mozilla Firefox\\Accessible*.dll") and
  not process.parent.executable :
                  ("?:\\Program Files\\HP\\Sure Click\\ApplicationSupport\\chrome\\*\\BrChrome.exe",
                   "?:\\Program Files (x86)\\HP\\Sure Click\\ApplicationSupport\\chrome\\*\\BrChrome.exe",
                   "?:\\Program Files (x86)\\Fuji Xerox\\DocuWorks\\bin\\dwviewer.exe",
                   "C:\\Program Files\\Druide\\*\\Connectix.exe",
                   "\\Device\\Mup\\*.exe") and
  not (process.command_line : "cmd.exe /c start outlook" and
       process.parent.executable : "?:\\Program Files\\WindowsApps\\Microsoft.OutlookForWindows_*\\olk.exe") and
  not (process.name : "regsvr32.exe" and
       process.command_line : "?:\\Windows\\sys*\\regsvr32.exe -s \"C:\\Users\\*\\G2MOutlookAddin64.dll\"" and
       process.parent.executable : "?:\\Users\\*\\AppData\\Local\\GoToMeeting\\*\\g2mlauncher.exe")
  ]