Suspicious Scheduled Task Creation

process where event.action == "start" and
  process.pe.original_file_name : "schtasks.exe" and
  not process.Ext.token.integrity_level_name == "system" and
  process.args : ("/create", "-create") and process.args : "/tr" and
  not process.command_line : ("*:\\Program Files\\*", "*:\\Program Files (x86)\\*") and
  not process.Ext.token.integrity_level_name == "system" and
  (
   process.args : ("*Users\\Public\\*", "*:\\Windows\\Tasks\\*", "*:\\Windows\\system32\\Tasks\\*") or 
   
   (process.args : "minute" and process.args : "/mo" and
    process.args : ("*\\AppData\\*", "*\\ProgramData\\*", "*Users\\Public\\*")) or

   (process.args : "HIGHEST" and process.args : "ONLOGON" and
    process.parent.name : ("wmiprvse.exe", "rundll32.exe", "regsvr32.exe") and
    not process.parent.command_line : "*rundll32*zzzzInvokeManagedCustomActionOutOfProc*") or

   (process.args : ("onlogon", "minute", "onstart", "daily", "once") and
    process.parent.name : "cmd.exe" and process.parent.command_line : "*schtasks*" and
    descendant of [process where event.action == "start" and not process.code_signature.trusted == true]) or

   (process.args : ("SYSTEM", "NT AUTHORITY\\SYSTEM") and process.args : "/ru" and
    process.command_line : ("*vssadmin*Delete*Shadows*", "*wmic*shadowcopy*", "*regsvr32*-s*")) or 
    
   process.command_line : ("*comspec*", "*cmd.exe*/c*", "*^*^*^*", "*powershell*", "*http*://*", "*mshta*", "* curl.exe*")
  ) and 
  
  not process.command_line : ("*\\bmx\\* shutdown.exe *", "*powershell.exe*Task*rubrik_vmware*") and
  not (process.parent.args : "C:\\ProgramData\\Prognos_Scripts\\OneDriveMapper\\OneDriveMapper.ps1" and process.command_line : "*powershell*") and
  not process.args :  ("'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe' -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C:\\Windows\\TEMP\\rubrik_vmware*\\post-restore.ps1 ",
                       "'C:\\ProWin22\\32bit\\ProSeriesBackgroundUpdater.exe' -p 'C:\\ProWin22' -y 22 -s Core", 
                       "C:\\ModentoBridge\\ModentoPowershellProxy\\schedulePSP.bat", 
                       "C:\\ModentoBridge\\ModentoPowershellProxy\\startProxy.bat", 
                       "C:\\ModentoBridge_1\\ModentoPowershellProxy\\startProxy.bat", 
                       "C:\\PROGRA~2\\*\\EXAQUA~1\\DEVELO~1\\EQPERF~1\\Config\\EQPERF~1.BAT",
                       "c:\\dona_adm\\admin\\*.exe") and
  not (process.parent.name : "powershell.exe" and process.args : "Rubrik Post Restore Task") and
  not process.command_line : "*\\ProgramData\\Atos\\custom-scanner\\scan_sox.cmd*" and
  not (process.parent.name : "wsmprovhost.exe" and process.command_line : "*TempGPUpdate*" and process.command_line : "*gpupdate*") and
  not (process.args : "& \"\\\\*" and process.args : "powershell") and 
  not (process.parent.name : "cmd.exe" and (process.parent.args :  "\\\\*" or process.parent.command_line : "\"C:\\WINDOWS\\system32\\cmd.exe\""))