Suspicious Bitsadmin Activity

process where event.action == "start" and
  (process.name : "bitsadmin.exe" or process.pe.original_file_name : "bitsadmin.exe") and
  process.command_line : ("*download*", "*transfer*", "*create*", "*addfile*", "*SetNotifyCmdLine*") and
  (process.parent.name : (
      "winword.exe",
      "excel.exe",
      "outlook.exe",
      "powerpnt.exe",
      "eqnedt32.exe",
      "fltldr.exe",
      "mspub.exe",
      "msaccess.exe",
      "acrord32.exe",
      "rdrcef.exe",
      "foxitphantomPDF.exe",
      "foxitreader.exe",
      "firefox.exe",
      "chrome.exe",
      "iexplore.exe",
      "opera.exe",
      "plugin-container.exe",
      "safari.exe",
      "microsoftedge.exe",
      "w3wp.exe",
      "httpd.exe",
      "nginx.exe",
      "php.exe",
      "php-cgi.exe",
      "tomcat.exe",
      "wscript.exe",
      "cscript.exe",
      "powershell.exe",
      "pwsh.exe",
      "cmd.exe",
      "mshta.exe"
      ) or
  descendant of [process where event.action == "start" and
    process.parent.name : (
      "winword.exe",
      "excel.exe",
      "outlook.exe",
      "powerpnt.exe",
      "eqnedt32.exe",
      "fltldr.exe",
      "mspub.exe",
      "msaccess.exe",
      "acrord32.exe",
      "rdrcef.exe",
      "foxitphantomPDF.exe",
      "foxitreader.exe",
      "firefox.exe",
      "chrome.exe",
      "iexplore.exe",
      "opera.exe",
      "plugin-container.exe",
      "safari.exe",
      "microsoftedge.exe",
      "w3wp.exe",
      "httpd.exe",
      "nginx.exe",
      "php.exe",
      "php-cgi.exe",
      "tomcat.exe",
      "wscript.exe",
      "cscript.exe",
      "powershell.exe",
      "pwsh.exe",
      "cmd.exe",
      "mshta.exe"
    )]) and
    not (process.args : "https://dl.duosecurity.com/*" and process.parent.args : "?:\\ProgramData\\NinjaRMMAgent\\scripting\\*") and
    not process.command_line : "bitsadmin  /RawReturn /GetBytesTransferred mingw" and
    not process.args :
             ("https://opalrtwebsitedata.blob.core.windows.net/software/mingw/*",
              "C:\\EMES\\workspace\\1.9\\sim.properties",
              "C:\\EMES\\rsd\\run.bat",
              "C:\\EMES\\rsd\\sim.properties",
              "C:\\EMES\\tmp\\restart_rsd.bat") and
    not process.executable : "?:\\Program Files (x86)\\Bosch\\DownloadManager\\bin\\Bitsadmin*.exe" and
    not (process.parent.name : "cmd.exe" and
         process.parent.command_line : (
            "C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\*.bat\"\"",
            "C:\\Windows\\SYSTEM32\\cmd.exe /c \"\"C:\\Program files\\vuls-saas\\vuls-saas.bat\"\""
        ))