Suspicious API Call from a PowerShell Script

api where
event.provider == "Microsoft-Windows-Threat-Intelligence" and process.Ext.api.parameters.size > 4096 and
process.Ext.api.name in ("VirtualProtect", "VirtualProtectEx", "WriteProcessMemory", "VirtualAlloc", "VirtualAllocEx", "MapViewOfFile", "MapViewOfFile2", "Wow64SetThreadContext", "SetThreadContext", "ReadProcessMemory", "connect") and
process.name in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and

process.Ext.api.metadata.target_address_path != "c:\\windows\\system32\\dante_dnssd.dll" and

/* PowerShell Script JIT - and incidental .NET assemblies */
process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
process.thread.Ext.call_stack_final_user_module.protection_provenance in ("clr.dll", "mscorwks.dll", "coreclr.dll") and

not (
  process.Ext.api.name == "VirtualProtect" and
    /* exclude nop operations */
    /* TBR */
    (process.Ext.api.parameters.protection in ("RWX", "RwX
| CFG") and process.Ext.api.parameters.protection_old == "RWX") or
    (process.Ext.api.parameters.protection in ("R-X
| CFG", "R-X") and process.Ext.api.parameters.protection_old in ("R-X", "RWX"))
) and

/* Citrix GPO Scripts */
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and
     process.Ext.api.summary in ("VirtualProtect( Unbacked, 0x10, RWX, RW- )", "WriteProcessMemory( Self, Unbacked, 0x10 )", "WriteProcessMemory( Self, Data, 0x10 )")) and

/* cybersecurity and other tools */
not process.parent.executable :
                 ("C:\\Program Files (x86)\\CyberCNSAgent\\cybercnsagent.exe",
                  "C:\\Program Files\\Velociraptor\\Velociraptor.exe",
                  "C:\\Program Files (x86)\\baramundi\\BMA\\BDSRun.exe",
                  "C:\\Program Files\\Huntress\\HuntressAgent.exe",
                  "C:\\Program Files (x86)\\N-able Technologies\\AutomationManagerAgent\\AutomationManager.AgentService.exe",
                  "C:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
                  "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                  "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseCM.exe",
                  "C:\\Program Files (x86)\\ITSPlatform\\plugin\\*.exe",
                  "C:\\Program Files (x86)\\ACMPClient\\ACMPClientService.exe",
                  "C:\\Program Files\\SGN Connect\\*\\sgncore.exe",
                  "C:\\Program Files (x86)\\Msp Agent\\components\\*\\generic-asset-interrogator.exe",
                  "C:\\Program Files (x86)\\CyberCNSAgentV2\\cybercnsagentv2.exe",
                  "C:\\Program Files\\RevBits EPS\\RevBitsEPS.exe",
                  "C:\\Program Files (x86)\\Quest\\KACE\\KInventory.exe",
                  "C:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoBatteryGaugeAddin\\*\\x64\\BGHelper.exe",
                  "C:\\Program Files\\PDQ\\PDQConnectAgent\\pdq-connect-agent.exe",
                  "C:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
                  "C:\\Program Files\\SentinelOne\\Sentinel Agent *\\Addons\\SentinelAddonHost.exe",
                  "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
                  "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                  "C:\\Program Files (x86)\\Microsoft Visual Studio\\Installer.*\\setup.exe",
                  "C:\\Windows\\CCM\\CcmExec.exe",
                  "C:\\Windows\\System32\\gpscript.exe",
                  "C:\\ProgramData\\NinjaRMMAgent\\*\\NinjaOrbit.exe",
                  "C:\\Program Files (x86)\\NinjaRMMAgent\\NinjaRMMAgent.exe",
                  "C:\\Program Files (x86)\\NinjaOne\\NinjaRMMAgent.exe") and

/* module listing */
not (process.Ext.api.name in ("EnumProcessModules", "GetModuleInformation", "K32GetModuleBaseNameW", "K32GetModuleFileNameExW") and
  process.parent.executable : ("*\\Lenovo\\*\\BGHelper.exe", "*\\Octopus\\*\\Calamari.exe")) and

/* WPM triggers multiple times at process creation */
not (process.Ext.api.name == "WriteProcessMemory" and
     process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo", "Data") and
     _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like ("*\\kernelbase.dll!CreateProcess*", "*\\kernel32.dll!CreateProcess*", "Unknown", "*\\kernelbase.dll+0x*", "*\\kernel32.dll+0x*"))) and

not (process.Ext.api.parameters.size == 16 and process.command_line : "*\\\\*\\Scripts\\GPO_Scripts\\*") and

not (process.parent.executable : "\\\\?\\Volume{*}\\Windows\\System32\\CExecSvc.exe" and
     process.command_line : "powershell -NoProfile -NoLogo -InputFormat text -OutputFormat text -NonInteractive -ExecutionPolicy Bypass -Command -") and
not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "41c6470c01*41c6470c01488b55*") and
not process.thread.Ext.call_stack_summary like
                           ("ntdll.dll
| inprocessclient64.dll
| kernelbase.dll
| inprocessclient64.dll
| Unbacked",
                            "ntdll.dll
| bdhkm64.dll
| atcuf64.dll
| bdhkm64.dll
| Unbacked
| ntdll.dll
| kernelbase.dll
| bdhkm64.dll
| Unbacked",
                            "ntdll.dll
| bdhkm64.dll
| Unbacked
| ntdll.dll
| kernelbase.dll
| bdhkm64.dll
| Unbacked",
                            "ntdll.dll
| umppc*.dll
| scriptcontrol64_*.dll
| Unbacked",
                            "ntdll.dll
| edrdotnet.unmanagedlib.???.dll
| Unbacked",
                            "ntdll.dll
| $$deletemekernelbase.dll*
| inprocessclient64.dll
| Unbacked",
                            "ntdll.dll
| hmpalert.dll
| advapi32.dll
| Unknown",
                            "ntdll.dll
| inprocessclient64.dll
| kernelbase.dll
| inprocessclient64.dll
| Unknown",
                            "ntdll.dll
| cyvrtrap.dll
| edrdotnet.unmanagedlib.???.dll
| Unbacked",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| protector32.dll
| kernelbase.dll
| protector32.dll
| Unbacked",
                            "ntdll.dll
| umppc*.dll
| bdhkm64.dll
| atcuf64.dll
| bdhkm64.dll
| Unbacked*",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| protector32.dll
| kernelbase.dll
| protector32.dll
| Unbacked",
                            "ntdll.dll
| minprocessclient.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| inprocessclient32.dll
| kernelbase.dll
| inprocessclient32.dll
| Unbacked
| clr.dll
| *",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| psninjhookms32.dll
| Unbacked
| psninjhookms32.dll
| Unbacked
| psninjhookms32.dll
| Unbacked
| clr.dll
| clrjit.dll
| clr.dll
| Unbacked*",
                            "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| dbgeng.dll
| Unbacked
| clr.dll
| dbgeng.dll
| mscorlib.ni.dll
| clr.dll
| powershell.exe
| kernel32.dll
| ntdll.dll",
                            "ntdll.dll
| clr.dll
| presentationcore.ni.dll
| clr.dll
| presentationcore.ni.dll
| clr.dll
| microsoft.powershell.gpowershell.ni.dll
| clr.dll
| mscorlib.ni.dll
| Unbacked") and
not _arraysearch(process.thread.Ext.call_stack, $entry,
                 $entry.callsite_trailing_bytes like ("41c644240c01*85f60f95c00fb6c00fb6c041c644240c01488b55884989542410488d65c85b5e5f415c41*",
                                                      "c6430c01*488d65c85b5e5f415c415d415e415f5dc3*",
                                                      "418845084d8bc5488bcf8bd3e8*b8010000004883c4285b5d5e5f415c415d415e415fc3*",
                                                      "834648fab8010000004883c4685b5d5e5f415c415d415e415fc3*",
                                                      "488b95c0feffffc6420c01*",
                                                      "*41c6470c01488b459049894710488d65c85b5e5f415c415d415e415f5dc30000001910090010*",
                                                      "488bc8488bd7488b00488b4040ff5030b901000000ba7b030000*",
                                                      "488945d8488b4dd8488bd6488b45d8488b00488b4040ff5030*",
                                                      "8b65e459c6460801833d48*",
                                                      "8b0c2464890d0000000083c40c5f5e5b5d*", "34006500330035*",
                                                      "904883c428c30019040100044200*",
                                                      "*488d65e05b5e5f415e5dc35541565756534883ec30c5f877488b692048*",
                                                      "*f8488b5e30488d4f08488bd6*", "488bc8488bd7488b00488b4040ff5030b*",
                                                      "8bf0488b4c2428488bf9488bcf488bf985f67479*")) and
not (process.Ext.api.name in ("VirtualProtect", "VirtualAlloc", "MapViewOfFile", "MapViewOfFile2") and
     _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like ("c:\\windows\\sy*\\ntdll.dll!Ldr*",
                                           "c:\\windows\\sy*\\kernelbase.dll!PackageSidFromProductId",
                                           "c:\\windows\\sys?????\\ntdll.dll!RtlAllocateHeap*",
                                           "c:\\windows\\sys?????\\dbgeng.dll!DebugCreateEx*",
                                           "c:\\windows\\system32\\ntdll.dll!LdrGetProcedureAddress*",
                                           "c:\\windows\\system32\\advapi32.dll!ReadEventLogW*"))) and
not (process.Ext.api.parameters.size <= 4096 and process.thread.Ext.call_stack_summary like ("ntdll.dll
| umppc*.dll
| scriptcontrol*.dll
| Unbacked", "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| dbghelp.dll
| Unbacked*")) and
not (process.parent.executable : "C:\\Windows\\System32\\gpscript.exe" and process.thread.Ext.call_stack_summary == "ntdll.dll
| Unknown
| yourphone.ypp.dll") and 
not process.thread.Ext.call_stack_summary like ("ntdll.dll
| Unknown*", "ntdll.dll
| kernelbase.dll
| Unknown")