Suspicious Microsoft OneNote Child Process

process where event.action == "start" and
  process.parent.name : "ONENOTE.EXE" and
  (
		process.pe.original_file_name : (
		    "rundll32.exe",
		    "regsvr32.exe",
		    "bitsadmin.exe",
		    "certutil.exe",
		    "installutil.exe",
		    "schtasks.exe",
		    "wmic.exe",
		    "cscript.exe",
		    "wscript.exe",
		    "cmstp.exe",
		    "Microsoft.Workflow.Compiler.exe",
		    "regasm.exe",
		    "regsvcs.exe",
		    "mshta.exe",
		    "msxsl.exe",
		    "ieexec.exe",
		    "cmd.exe",
		    "powershell.exe",
		    "hh.exe",
		    "javaw.exe",
		    "pcalua.exe",
		    "curl.exe",
		    "ScriptRunner.exe",
		    "CertOC.exe",
		    "Workfolders.exe",
		    "odbcconf.exe",
		    "msiexec.exe",
		    "msdt.exe")
		 or

		(process.name : "explorer.exe" and
		 process.args : ("*.hta*", "*.vb*", "*.wsh*", "*.js*", "*.ps*", "*.scr*", "*.pif*", "*bat*", "*.cmd*")) or

		process.executable : ("?:\\Users\\*\\AppData\\*",
		                      "?:\\Users\\Public\\",
		                      "?:\\ProgramData\\*",
		                      "?:\\Windows\\Tasks\\*",
		                      "?:\\Windows\\Temp\\*",
		                      "?:\\Windows\\System32\\Tasks\\*")
  ) and

  /* many FPs like browsers and chat desktop apps */
  not (process.executable : "?:\\Users\\*\\AppData\\*" and process.code_signature.trusted == true) and
  not (process.name : "rundll32.exe" and process.command_line : "*windows\\system32\\spool\\DRIVERS\\*MonitorPrintJobStatus*") and
  not (process.pe.original_file_name == "Teams.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and
  not (process.name : "rundll32.exe" and process.args : "?:\\Program Files (x86)\\AllesTechnologyAgent\\Super Shield\\SuperShieldHookCpy32.dll,#1") and 
  not (process.code_signature.trusted == true and process.code_signature.subject_name : ("VideoLAN", "Interact Digital AG"))