Suspicious Microsoft IIS Worker Descendant

process where event.action == "start" and
(
  (
    process.parent.name : "w3wp.exe" and
    (
      (process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE") and
        (process.command_line : ("*/c powershell*", "*&cd&echo*", "*certutil*", "*bitsadmin*", "*/c cd /d *",
                                "*http*", "*.replace*", "*Reflection.Assembly*", "*$*$*$*$*$*", "*^*^*^*^*^*^*",
                                "*set *set *set *", "* wget*") or
        process.args : ("?:\\Users\\Public\\*", "?:\\Windows\\Tasks\\*", "?:\\Windows\\Temp\\*", "?:\\windows\\help\\*"))) or

      (process.pe.original_file_name == "PowerShell.EXE" and length(process.parent.command_line) >= 150 and
        process.parent.command_line : ("* -enc*", "* -e *", "* bypass*")) or

      (process.parent.args : ("MSExchange*", "SharePoint*") and
        process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "CertUtil.exe", "CertReq.exe", "curl.exe", "RUNDLL32.EXE", "REGSVR32.EXE")) or

      (process.pe.original_file_name == "Cmd.Exe" and process.args_count ==1)
    )
  ) or

  (descendant of [process where process.name : "w3wp.exe"] and
  (
    (process.name : ("net.exe", "net1.exe") and process.command_line : ("*administrators*", "*remote desktop*", "*use \\* /user*")) or
    (process.pe.original_file_name in ("CertUtil.exe", "CertReq.exe", "curl.exe", "bitsadmin.exe"))
   )
  ) or

  (descendant of [process where process.parent.name : "w3wp.exe" and
    process.pe.original_file_name == "Cmd.Exe" and process.command_line : ("*/c powershell*", "*&cd&echo*")]
  )
)
/* False Positives */
and not (process.name : "cmd.exe" and process.parent.args : "Icims" and process.command_line : "*vault.azure.net*" and process.parent.name : "w3wp.exe") and
not (process.name : "powershell.exe" and process.command_line : "\"powershell.exe\" netsh http show servicestate
| ?{$_.Tostring().Contains(*") and
process.hash.sha256 != "fe1d2ad2781879dc05039d87bd12259f3bcf411c66c925d31827d6a757d33ec4" and
not (process.name : "cmd.exe" and process.parent.name:"w3wp.exe" and
     process.args:"'HttpsPortDesktopAgent'),"  and process.args : "echo" and process.parent.args : "DefaultAppPool") and
not (process.name == "conhost.exe" and process.parent.name == "cmd.exe") and
not (process.name : "curl.exe" and process.args : "https*.lansweeper.com" and process.parent.name : "w3wp.exe" and process.parent.args : "Lansweeper AppPool")