Shellcode Injection via PowerShell

api where process.Ext.api.name in ("VirtualAlloc", "VirtualAllocEx", "VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "connect") and
    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
    process.Ext.api.behaviors in ("shellcode", "allocate_shellcode") and
    process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
    process.thread.Ext.call_stack_final_user_module.protection_provenance == "Unbacked" and
    (process.Ext.api.name == "connect" or process.Ext.api.parameters.size >= 10000) and
    process.thread.Ext.call_stack_summary like "?*" and
    _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "Unbacked*" and $entry.callsite_trailing_bytes : "?*") and

    /* noisy patterns */
    not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "Unbacked*" and
                     $entry.callsite_trailing_bytes like
                                   ("*85f60f95c10fb6c9894dac488bcce82f000000908b45ac0fb6c0488b55a0c6420c01*",
                                    "488dac24d00000004c8bb424a8000000*4c8b45f84d8d4e08*",
                                    "*85f60f95c10fb6c9894dac488bcce82f000000908b45*", 
                                    "*7f00004883c42848ffe000190401000442000040000*", 
                                    "488986200f0000488d8fe00d000048894*", 
                                    "*8bc6488d65f85e5dc355564883ec28488b6920*")) and
    not (process.thread.Ext.call_stack_summary  == "ntdll.dll
| Unbacked" and
         _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance == "Unknown")) and
    not process.thread.Ext.call_stack_summary like ("Unbacked", "*Unknown*") and
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.protection_provenance like ("Kernel", "clr.dll", "coreclr.dll", "fships.dll*", "Kernel
| *", "tmmon.dll",
                                                     "mfehcthe.dll", "mfehcs.exe
| mfehcs.exe", "conemuhk64.dll", "tmmon64.dll", "dwadv.dll", "bdhkm32.dll")) and
    not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("?:\\Program Files\\*.dll*",
                                           "?:\\Program Files (x86)\\*.dll*",
                                           "?:\\windows\\system32\\*\\tmmon*.dll*",
                                           "c:\\windows\\syswow64\\ntdll.dll!RtlInitializeExceptionChain*",
                                           "c:\\windows\\syswow64\\ntdll.dll!RtlGetFullPathName*",
                                           "c:\\windows\\syswow64\\ntdll.dll!RtlGetAppContainerNamedObjectPath*")) and
    not (process.Ext.api.name == "connect" and process.parent.executable : "C:\\Program Files\\Tychon\\TychonEngine.exe") and
    not (user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
         process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\services.exe") and
         _arraysearch(process.thread.Ext.call_stack, $entry, $entry.protection_provenance == "Unbacked")) and
    not (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
         process.thread.Ext.call_stack_final_user_module.protection_provenance_path == "c:\\windows\\syswow64\\sppc.dll") and
    not process.parent.executable : "C:\\Program Files (x86)\\Msp Agent\\components\\generic-asset-interrogator\\0.2.10\\generic-asset-interrogator.exe" and
    not (process.Ext.api.name == "VirtualProtect" and
         _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!LdrLoadDll*", "c:\\windows\\sys?????\\kernelbase.dll!LoadLibrary*"))) and
    not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                     $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher", "Microsoft Windows Software Compatibility Publisher", "SentinelOne Inc.")) and
    not process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\assembly\\nativeimages_*\\microsoft.powershell.commands.diagnostics.ni.dll"