Shellcode from Unusual Microsoft Signed Module

api where
    process.executable != null and process.parent.executable != null and
    process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
    process.Ext.api.name in ("VirtualAlloc", "VirtualProtect", "WriteProcessMemory", "VirtualProtectEx", "VirtualAllocEx",
                             "MapViewOfFile", "MapViewOfFile2", "SetThreadContext", "SuspendThread", "ReadProcessMemory", "connect") and
    process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
    process.thread.Ext.call_stack_final_user_module.protection_provenance_path != null and
    _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry,
                 $entry.trusted == true and $entry.subject_name in ("Microsoft Corporation", "Microsoft Windows")) and
    process.thread.Ext.call_stack_summary :
                        ("ntdll.dll
| Unbacked",
                         "ntdll.dll
| kernelbase.dll
| Unbacked",
                         "ntdll.dll
| kernelbase.dll
| kernel32.dll
| Unbacked",
                         "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked",
                         "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked",
                         "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                         "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| Unbacked
| kernel32.dll
| ntdll.dll",
                         "ntdll.dll
| mswsock.dll
| ws2_32.dll
| Unbacked",
                         "wow64cpu.dll
| wow64.dll
| ntdll.dll
| mswsock.dll
| ws2_32.dll
| Unbacked
| kernel32.dll
| ntdll.dll") and
    process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\system32\\*" and

    not (process.executable : "C:\\Program Files\\Dell\\DTP\\InstrumentationSubAgent\\Dell.TechHub.Instrumentation.SubAgent.exe" and 
         process.parent.executable : "C:\\Program Files\\Dell\\TechHub\\Dell.TechHub.exe" and 
         process.code_signature.subject_name == "Dell Technologies Inc." and process.code_signature.trusted == true) and

    not (process.parent.executable : "C:\\Program Files (x86)\\ScreenConnect Client*\\ScreenConnect.ClientService.exe" and
        process.executable : "C:\\Program Files (x86)\\ScreenConnect Client (*)\\ScreenConnect.WindowsClient.exe" and
        process.code_signature.subject_name == "ConnectWise, LLC" and process.code_signature.trusted == true) and

    not (process.name == "powershell.exe" and user.id == "S-1-5-18" and
         process.parent.executable : "C:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe") and

    not process.thread.Ext.call_stack_final_user_module.protection_provenance : ("cyvrtrap.dll", "bass.dll") and

    not (process.executable : "C:\\Windows\\System32\\PrintIsolationHost.exe" and
         process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\system32\\msvcr100.dll") and

    not (process.executable : "C:\\Windows\\System32\\inetsrv\\w3wp.exe" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and 
         _arraysearch(process.thread.Ext.call_stack, $entry, 
                      $entry.callsite_trailing_bytes : ("41c644240c01*488b558849895424104883c4785b5e5f415c415d415e415f5dc3*", 
                                                        "41c6470c01833*488bc6488b5590498957104883c4685b5e5f415c415*",
                                                        "*85f60f95c00fb6c00fb6c041c6470c01488b558849895710488d65c85b5e5f415c415d415e*"))) and

    not (process.parent.executable : "C:\\Program Files\\ATERA Networks\\AteraAgent\\Agent\\AteraAgent.exe" and
         process.executable : "C:\\Program Files\\ATERA Networks\\AteraAgent\\Agent\\packages\\AgentPackageMonitoring\\AgentPackageMonitoring.exe")