Suspicious Oversized Script Execution

sequence with maxspan=2m
 [file where event.action != "deletion" and
  file.extension : ("js", "vbs", "jse", "vbe", "wsh", "hta", "wsf") and
  (
   process.name : ("explorer.exe", "cmd.exe", "powershell.exe", "winrar.exe", "expand.exe", "wscript.exe", "cscript.exe", "msiexec.exe",
                  "chrome.exe", "msedge.exe", "firefox.exe", "7zFM.exe", "7zG.exe", "python*.exe", "certutil.exe", "mshta.exe") or
   (process.code_signature.exists == false or process.code_signature.trusted == false)
   ) and
  /* more than 0.4MB */
  file.size >= 400000 and file.path : ("?:\\Users\\*", "?:\\ProgramData\\*", "?:\\Windows\\Temp\\*", "?:\\Windows\\Tasks\\*")] as event0
 [process where event.action == "start" and
  process.name : ("wscript.exe", "cscript.exe", "mshta.exe") and process.args_count >= 2 and
  stringcontains~(process.command_line, event0.file.name)]