Script Interpreter Process Writing to Commonly Abused Persistence Locations

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and
   process.pe.original_file_name : ("cscript.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "java.exe") and
   not (process.name : "powershell.exe" and process.parent.executable : "C:\\Windows\\ccmcache\\*.exe") and
   not (process.name : "powershell.exe" and process.parent.name : "cmd.exe" and process.parent.args : ("?:\\Windows\\ccmcache\\*", "\\\\*")) and
   not (process.name : "powershell.exe" and process.command_line : "*\\cc-agent-install\\*\\CommandCenterAgent.ps1*")
   ]
  [any where event.category : ("registry", "file") and event.action != "deletion" and
   (
    (registry.data.strings != null and
     registry.path :
            ("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   )
   ]
 [any where event.category : ("registry", "file") and event.action != "deletion" and
   (
    (registry.data.strings != null and
     registry.path :
            ("*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
             "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
             "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*")) or
    (file.name != null and file.path : "?:\\*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
   )
   ]