Suspicious Windows Script Interpreter Child Process

process where event.type == "start" and
  process.parent.name : ("wscript.exe", "mshta.exe") and
  process.parent.args_count >= 2 and
  not process.Ext.token.integrity_level_name == "system" and
   (
    process.name : ("rundll32.exe", "odbcconf.exe") or

   (process.name : ("cmd.exe", "powershell.exe", "curl.exe") and process.parent.name : "mshta.exe") or

    /* suspicious or unusual paths */
    process.executable : ("?:\\Windows\\Microsoft.NET\\*",
                          "?:\\Users\\Public\\*",
                          "?:\\Windows\\Tasks\\*",
                          "?:\\Windows\\System32\\Tasks\\*") or

     /* potential hollowed trusted system process with no arguments */
    (process.args_count == 1 and
     process.executable : ("?:\\Windows\\System32\\*.exe", "?:\\Windows\\SysWOW64\\*.exe") and
     process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft *" and
     not process.name : ("conhost.exe", "gpupdate.exe", "logoff.exe", "HOSTNAME.EXE"))
     ) and
     not (process.parent.name : "mshta.exe" and process.parent.args : "?:\\Program Files\\HP\\*\\HPSolutionsPortal.hta") and
     not (process.name : "regsvr32.exe" and process.parent.name : "wscript.exe" and process.parent.command_line : ("*LiteTouch.wsf*", "*LTICleanup.wsf*")) and
     not (process.pe.original_file_name == "acslaunch" and process.executable : "?:\\Users\\Public\\IBM\\*.exe") and
     not (process.name : ("rundll32.exe", "regsvr32.exe") and
          process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "ndfapi.dll,NdfRunDllDiagnoseWithAnswerFile", "?:\\Windows\\sysWOW64\\*.ocx")) and
     not process.executable : ("?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\caspol.exe", "?:\\Windows\\System32\\Vmw.exe") and
     not (process.name : "rundll32.exe" and process.args : "UpdatePerUserSystemParameters" and process.args : "user32.dll,") and
     not (process.executable : "?:\\Windows\\System32\\Vmw.exe" and process.parent.args : "kms_host.vbs") and
     not (process.name : "regsvr32.exe" and process.args : "C:\\nondefault\\System\\*.exe" and process.args : "/u") and 
     not (process.name : ("rundll32.exe", "regsvr32.exe", "regasm.exe") and process.args : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*")) and
     not process.executable : ("?:\\WINDOWS\\Microsoft.NET\\Framework\\*\\caspol.exe", "?:\\Windows\\System32\\Vmw.exe") and
     not (process.name : "rundll32.exe" and
          process.args : ("printui.dll,PrintUIEntry", "user32.dll,UpdatePerUserSystemParameters", "dfshim.dll,ShArpMaintain")) and
     not (process.name : "regsvr32.exe" and process.args : ("?:\\Windows\\sysWOW64\\*.ocx", "?:\\EQ\\System\\QXLAddInDialogs.exe")) and
     not (process.code_signature.subject_name : "Dassault Systemes SolidWorks Corp." and process.code_signature.trusted == true) and
     not (process.parent.name : "cscript.exe" and
          process.parent.args : "?:\\Windows\\Options\\SWD\\MapHomeDrive_*.vbs" and process.name : "mshta.exe") and
     not (process.name : "rundll32.exe" and process.parent.args : "?:\\Program Files (x86)\\PCMatic\\PC Matic\\registerActiveX.wsf") and
     not process.command_line : "mshta.exe" and
     not (process.name : "wscript.exe" and process.args : "\\\\*\\netlogon\\*.vbe") and
     not (process.name : "rundll32.exe" and process.args: "C:\\ProgramData\\FastTrack Software\\Admin By Request\\ShellHelper32.dll,#1") and
     not (process.name: ("cmd.exe", "regsvr32.exe") and process.parent.executable : "C:\\Windows\\SysWOW64\\mshta.exe") and
     not (process.executable : "?:\\Windows\\System32\\odbcconf.exe" and process.args : "configdsn") and
     not process.hash.sha256 in ("13eacb4b57ac207f7f5c118915359a6e66a7f52f7154f8bb577f54b48b0d5e68", "6e0cb7d79cfc0b51468904701ff5227270180b9c8ff79d181000049ce991fc5a") and
     not (process.parent.name : "mshta.exe" and
          process.executable : ("C:\\Windows\\SysWOW64\\cmd.exe", "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe") and
          process.working_directory : ("C:\\Users\\*\\AppData\\Roaming\\DriverPack Notifier\\bin\\", "\\\\*")) and
     not (process.parent.executable : "C:\\Windows\\SysWOW64\\mshta.exe" and process.name : "rundll32.exe" and process.args == "dsquery.dll,OpenQueryWindow") and
     not (process.name : "cmd.exe" and process.command_line : "\"C:\\Windows\\System32\\cmd.exe   /C mklink /D *")