Suspicious Microsoft Office Child Process

process where event.action == "start" and
  process.parent.name : ("excel.exe", "powerpnt.exe", "winword.exe") and
  (
		(process.pe.original_file_name : (
		    "rundll32.exe", 
		    "regsvr32.exe", 
		    "bitsadmin.exe",
		    "certutil.exe", 
		    "installutil.exe", 
		    "schtasks.exe", 
		    "wmic.exe", 
		    "cscript.exe",
		    "cmstp.exe", 
		    "Microsoft.Workflow.Compiler.exe", 
		    "regasm.exe", 
		    "regsvcs.exe", 
		    "mshta.exe", 
		    "msxsl.exe", 
		    "ieexec.exe", 
		    "sc.exe",
		    "javaw.exe",
		    "pcalua.exe",
		    "curl.exe",
		    "ScriptRunner.exe",
		    "CertOC.exe",
		    "Workfolders.exe",
		    "odbcconf.exe",
		    "extrac32.exe",
		    "expand"
		   ) and
		not process.args : ("-Embedding", "-hashfile")
		) or
		
		(process.pe.original_file_name : "wscript.exe" and
		 process.command_line : ("*:\\ProgramData\\*",
		                         "*:\\Users\\Public\\*",
		                         "*\\AppData\\*",
		                         "*\\Windows\\Temp\\*",
		                         /* CVE-2021-40444 */
		                         "*../../..*", "*..\\..\\*", "*js:..*", "*vbs:..*", "*wsf:..*", "*jse:..*", "*vbe:..*")) or
		
		(process.pe.original_file_name : "msiexec.exe" and process.args : "http*") or
		/* Issue #439 */
		(process.name : "explorer.exe" and
		 process.args : ("*.hta*", "*.vb*", "*.wsh*", "*.js*", "*.ps*", "*.scr*", "*.pif*", "*bat*", "*.cmd*") and
		 /* FPs related to execution from file share */
		 not process.working_directory : "\\\\*"
		 ) or

		/* Masquerading as WerFault or Splwow64 both of which are common MS Office Child Processes */
		(process.name : ("WerFault.exe", "splwow64.exe") and process.args_count == 1) or

        /* in the wild 0 day - 52945af1def85b171870b31fa4782e52 */
		(process.pe.original_file_name == "msdt.exe" and process.command_line : "*IT_BrowseForFile*")

  ) and

	/* FP related to printing */
	not (process.name : "rundll32.exe" and process.command_line : "*\\system32\\spool\\*") and

	/* Issue #458 */
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", "shwebsvc.dll,AddNetPlaceRunDll")) and

    /* Issue #568 */
	not (process.name : "schtasks.exe" and process.args : "/change" and process.args : "Microsoft\\Office\\Office Serviceability Manager") and

	/* Issue #568 */
	not (process.name : "regsvr32.exe" and
	     process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\system32\\*.dll", "?:\\Windows\\system32\\*.ocx")) and

	not (process.executable : "?:\\Windows\\hh.exe" and process.args : "-mapid") and
	not (process.executable : "?:\\Windows\\System32\\sc.exe" and process.args : "queryex") and
	not (process.name : "rundll32.exe" and process.command_line : ("?:\\Windows\\SysWOW64\\rundll32.exe --eoim", "*--enable-speech-input --auto-scan-plugin --lang=*")) and
	not (process.name : "RegAsm.exe" and process.args :  "?:\\Program Files (x86)\\Thomson Reuters\\WSF\\*.dll") and
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\WINDOWS\\system32\\hotplug.dll,HotPlugSafeRemovalDriveNotification",
	                     "printui.dll,PrintUIEntry",
	                     "InetCpl.cpl,ClearMyTracksByProcess",
	                     "url.dll,FileProtocolHandler")) and
	not (process.name : "hh.exe" and process.args : ("?:\\Program Files (x86)\\*", "?:\\Program Files (x86)\\*")) and
	not (process.name : "rundll32.exe" and process.command_line : "\"C:\\WINDOWS\\SysWOW64\\rundll32.exe\" --eoim") and
	not (process.name : "rundll32.exe" and process.args : "?:\\PROGRA~2\\MICROS~*\\Office*\\GrooveUtil.DLL,GetResourceModulePath") and
	not (process.name : "hh.exe" and process.args : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*")) and
	not (process.name : "javaw.exe" and process.args : "?:\\PROGRA~2\\Andar\\ANDARP~1\\bin\\andar.jar") and
	not (process.name : "rundll32.exe" and
	     process.args : ("?:\\Windows\\System32\\LogiLDA.dll,LogiFetch", "?:\\Windows\\System32\\dfshim.dll,ShOpenVerbShortcut")) and
	not (process.name : "rundll32.exe" and process.args : "-localserver" and process.args : "22d8c27b-47a1-48d1-ad08-7da7abd79617") and
	not process.executable : "?:\\Program Files (x86)\\Andar\\Jre*\\bin\\javaw.exe" and
	not (process.name : "mshta.exe" and process.args : "vbscript:close(CreateObject(WScript.Shell).Popup(Works only at day level,1,Warning))") and
	not (process.name : "rundll32.exe" and process.command_line : "\"C:\\Windows\\system32\\rundll32.exe\" --eoim")