Suspicious Command Execution via Windows Run

process where event.action == "start" and
 (
   process.name : ("cmd.exe", "powershell.exe", "curl.exe", "msiexec.exe", "mshta.exe", "wscript.exe", "cscript.exe") or 
   (process.name : "rundll32.exe" and process.command_line : "*\\\\*@*,*")
 ) and
 process.parent.name : "explorer.exe" and process.args_count >= 2 and
 (
  process.parent.thread.Ext.call_stack_summary like "ntdll.dll
| kernelbase.dll
| kernel32.dll
| windows.storage.dll
| shell32.dll
| user32.dll
| shell32.dll
| explorer.exe
| shcore.dll
| *" or
  (process.parent.thread.Ext.call_stack_summary like "*
| user32.dll
| shell32.dll
| explorer.exe
| shcore.dll
| *" and
   _arraysearch(process.parent.thread.Ext.call_stack, $entry, 
                $entry.symbol_info like ("C:\\Windows\\System32\\user32.dll!DialogBoxParamW*", 
                                         "C:\\Windows\\System32\\user32.dll!DialogBoxIndirectParamW*", 
                                         "C:\\Windows\\System32\\shell32.dll!GetFileNameFromBrowse*")))
 ) and
 not (process.name : "cmd.exe" and
      process.args : ("*.bat*", "*.cmd", "dir", "ipconfig", "C:\\WINDOWS\\system32\\sconfig.cmd ", "Code\\bin\\code.cmd ", "mkdir",
                      "C:\\Users\\*.cmd ")) and
 not (process.name : "powershell.exe" and process.args : ("Start-Process powershell -Verb RunAs", "C:\\*.ps1", "-SPLAGroup", "\\\\*\\netlogon\\*.ps1")) and
 not (process.name : "msiexec.exe" and process.args : "?:\\*.msi") and
 not process.command_line : ("\"C:\\WINDOWS\\system32\\cmd.exe\" /k net use",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" -a",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start terminal",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" D:\\",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /admin",
                             "\"C:\\Windows\\system32\\msiexec.exe\" /regserver",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start WindowsTerminal",
                             "\"C:\\WINDOWS\\system32\\cmd.exe\" /c start chrome --app=D:\\Notify\\index.html",
                             "\"C:\\windows\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ep bypass",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" ise",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -Command Start-Process PowerShell -Verb RunAs",
                             "C:\\WINDOWS\\system32\\cmd.exe /c \"\"C:\\Users\\*\\AppData\\Roaming\\npm\\*z.cmd\" \"",
                             "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -ExecutionPolicy Bypass") and
 not (process.name : ("wscript.exe", "cscript.exe") and process.args : ("\\\\*\\MapNetworkDrives.vbs", "?:\\*.js", "?:\\*.vbs")) and
 not (process.name : "powershell.exe" and process.args : "-command" and process.args : "vnc") and
 not (process.name : ("msiexec.exe", "powershell.exe", "wscript.exe") and process.working_directory : "\\\\*") and
 not (process.name : "msiexec.exe" and process.args :  "\\\\*\\SYSVOL\\*.msi")