Suspicious Windows API Call from Virtual Disk or USB

sequence by process.entity_id with maxspan=2m
[process where event.action == "start" and
   process.Ext.device.product_id like ("Virtual DVD-ROM", "Virtual Disk", "USB *") and
   not process.executable : "C:\\*" and not process.Ext.device.nt_name: "\\Device\\HarddiskVolume*" and 
   not process.Ext.device.vendor_id == "Citrix" and 
   not (process.code_signature.subject_name in ("Veeam Software Group GmbH", "VMware, Inc.") and process.code_signature.trusted == true) and
   not (process.executable : "?:\\FirefoxPortable\\App\\Firefox\\firefox.exe" and 
        process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)]
[api where event.category == "intrusion_detection" and
  process.Ext.api.behaviors in ("shellcode", "allocate_shellcode", "execute_shellcode") and
  not process.Ext.api.name in ("SetWindowsHookEx", "NtQueueApcThread") and process.Ext.api.parameters.size > 4096 and
  not process.Ext.api.summary like
                      ("VirtualProtect( user32.dll,*)",
                       "VirtualProtect( clr.dll,*",
                       "VirtualProtect( mscorwks.dll,*",
                       "VirtualProtect( pidgenx.dll,*",
                       "VirtualProtect( sop_check.dll,*",
                       "VirtualProtect( 7-zip.dll,*",
                       "VirtualProtect( umppc*",
                       "VirtualProtect( brc???.tmp,*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry,
                   $entry.protection_provenance like ("Kernel", "Kernel
| *", "hmpalert.dll", "bdhkm32.dll", "tmmon.dll", "ftapihook32.dll")) and
  not process.thread.Ext.call_stack_summary like
        ("ntdll.dll
| Unknown
| umppc*.dll
| ntdll.dll",
         "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| ftapihook32.dll
| ntdll.dll
| kernelbase.dll
| ntdll.dll")]