Suspicious Windows Script Process Execution

sequence by process.entity_id with maxspan=3m
[process where event.action == "start" and
 (process.name == "wscript.exe" or process.pe.original_file_name == "wscript.exe") and
 not process.Ext.token.integrity_level_name == "system" and
 process.working_directory != null and 
  (
    /* execution from a RA or ZIP file */
    process.working_directory :
          ("?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\7z*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\Rar$*",
           "?:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*") or
    process.command_line :
          (
            /* JScript9 */
           "*{16d51579-a30b-4c8b-a276-0ff4dc41e755}*",

            /* JScript or VBScript Language Encoding */
           "*{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*",
           "*{B54F3743-5B07-11cf-A4B0-00AA004A55E8}*",

           /* chakra */
           "*{1b7cd997-e5ff-4932-a7a6-2a9e636da385}*",
           
           /* appdata folder */
           "*\\AppData\\Local\\Temp\\*",
           "*\\AppData\\Roaming\\*"
           ) or
    (
     process.command_line : "*\\Users\\*\\AppData\\Local\\Temp\\Temp?_*" and
     process.args_count == 2
    )
  ) and

  /* most legit executions from temp come from System32 working dir */
  not (process.command_line : ("*\\AppData\\Local\\Temp\\*", "*\\AppData\\Roaming\\*") and
       process.working_directory : "?:\\Windows\\system32\\" and not process.parent.name : "explorer.exe") and
  not process.parent.executable : ("?:\\Program Files\\Adobe\\Adobe After Effects *\\Support Files\\AfterFX.exe",
                                   "?:\\Program Files (x86)\\Microsoft Dynamics NAV\\*\\Classic\\finsql.exe",
                                   "?:\\Program Files (x86)\\Epson Software\\Download Navigator\\EPSDNRUD.EXE",
                                   "?:\\Program Files (x86)\\BizTalkHealthMonitor\\BHMCOLLECT.EXE",
                                   "?:\\Program Files (x86)\\WINDEV\\AD_Voyager\\AD_voyager.exe",
                                   "?:\\Program Files\\Windev\\AD_Voyager\\AD_voyager.exe",
                                   "?:\\Program Files (x86)\\Kovai Ltd\\BizTalk360\\Service\\BHMCollect.exe") and
  not process.working_directory : ("?:\\Windows\\system32\\spool\\DRIVERS\\*", "?:\\windows\\system32\\driverstore\\filerepository\\*") and
  not process.command_line : "*AppData\\Roaming\\Nextech\\NxTSAddin\\ContingencyUninstallNXTSForCurrentUser.vbs*" and 
  not (process.parent.args : "%TEMP%\\Spiceworks\\spiceworks_upload.vbs" and process.working_directory : "?:\\Program Files (x86)\\Spiceworks\\") and
  not (process.name : "cscript.exe" and process.args : "D:\\Production Mid Server ??\\agent\\scripts\\WMI\\WMIRunner.js") and
  not (process.name : "cscript.exe" and process.parent.name : "cmd.exe" and process.parent.args : "cscript //Nologo //T:?00 D:\\Production")
  ]
 [network where event.action == "connection_attempted"]