Shellcode Execution via Python Script

api where process.code_signature.subject_name == "Python Software Foundation" and
 not process.Ext.api.name in ("TpAllocWork", "TpCallbackStart") and
 process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
 not process.thread.Ext.call_stack_final_user_module.protection_provenance like ("Kernel", "Kernel
| *", "Unknown", "Unknown
| *", "clr.dll") and
 not process.thread.Ext.call_stack_final_user_module.name in ("Unknown", "Kernel") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance like "conemuhk64.dll*") and
 not (process.Ext.api.name == "VirtualProtect" and _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "c:\\windows\\system32\\ntdll.dll!LdrLoadDll*")) and
 not (process.parent.executable : "C:\\Program Files\\pgAdmin ?\\runtime\\pgAdmin?.exe" and process.executable : "C:\\Program Files\\pgAdmin ?\\python\\python.exe") and
 not process.Ext.api.metadata.target_address_path : "c:\\windows\\system32\\tmumh\\20019\\tmmon\\2.9.0.1181\\tmmon64.dll" and
 not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked") and
 not (process.Ext.api.name in ("NtQueueApcThread", "SetThreadContext") and process.Ext.api.behaviors == "execute_shellcode" and
      _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys*\\kernelbase.dll!CreateProcess*", "c:\\program files\\eset\\eset security\\ebehmoni.dll*"))) and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher", "Bromium UK Limited"))