Suspicious Windows Script Base64 Encoding

api where process.Ext.api.name == "AmsiScanBuffer" and process.executable != null and
 process.name in~ ("wscript.exe", "mshta.exe", "msxsl.exe") and
  (process.Ext.api.parameters.buffer : "*bin.base64*" and
   process.Ext.api.parameters.buffer : ("*.Run(*", "*.ShellExecute(*", "*.responseBody*", "*XMLHTTP*", "*WinHttp*", "*.responseText*", "*http:*", "https:*")) and

  not process.Ext.api.parameters.content_name : ("?:\\Program Files (x86)\\*", "?:\\Program Files\\*", "C:\\Windows\\IMECache\\*\\RunHidden.vbs") and
  not process.parent.executable :
                     ("?:\\Program Files\\HP\\*.exe",
                      "?:\\Program Files (x86)\\Tanium\\Tanium Client\\TaniumClient.exe",
                      "?:\\Program Files\\Bentley\\*.exe",
                      "?:\\Program Files\\System Center Operations Manager\\Gateway\\MonitoringHost.exe",
                      "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
                      "?:\\Program Files\\Common Files\\Bentley Shared\\CONNECTION Client\\Bentley.Connect.Client.exe",
                      "?:\\Program Files (x86)\\Bentley\\*.exe",
                      "?:\\Program Files\\Bentley\\*.exe",
                      "?:\\Windows\\LSDeployment\\RemoteDeployment*.exe")