Suspicious WMI Enumeration via Windows Scripts

api where process.name in~ ("wscript.exe", "mshta.exe", "msxsl.exe") and
  process.Ext.api.name == "IWbemServices::ExecQuery" and
  process.Ext.api.summary :
                ("IWbemServices::ExecQuery( Select * from Win32_ComputerSystemProduct )",
                 "IWbemServices::ExecQuery( Select * from Win32_Process Where Name*") and
  not process.command_line :
                ("cscript.exe  //NoLogo //B ?:\\Windows\\System32\\slmgr.vbs *",
                 "\"C:\\WINDOWS\\System32\\WScript.exe\" \"\\\\*",
                 "cscript  \"C:\\Program Files (x86)\\Microsoft Office\\Office??\\ospp.vbs\" /dstatus",
                 "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Program Files (x86)\\LIEBHERR\\LIKAPLAN\\starteplocal.vbs\" ",
                 "\"C:\\Windows\\system32\\wscript.EXE\" \"C:\\Program Files\\Barracuda SSM\\launchCommonAgent.vbs\"",
                 "\"C:\\Windows\\system32\\wscript.EXE\" \"C:\\Program Files\\Barracuda SSM\\launchSaasAgent.vbs\"",
                 "C:\\WINDOWS\\System32\\WScript.exe \"C:\\Program Files\\Consol\\DhaService\\StartToolbox.vbs\" ",
                 "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Program Files (x86)\\Wireless Monitor System V*\\start.vbs\" ",
                 "\"wscript.exe\" \"C:\\Program Files\\Windows Azure VM Agent *\\\\InstallOrUpdateGA.vbs\"",
                 "*\\Windows\\SysWOW64\\mshta.exe*\\ThinkBiosConfig.hta*") and
  not process.Ext.api.summary :
                  ("IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'JAVAW.EXE' )",
                   "IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'POS.EXE' )",
                   "IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'dcagenttrayicon.exe' )",
                   "IWbemServices::ExecQuery( 
SELECT * 
FROM Win32_Process 
WHERE Name = 'Tracker.exe'  )",
                   "IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'RapidReprice1G.exe' )",
                   "IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'Tracker.exe' )",
                   "IWbemServices::ExecQuery( Select Name from Win32_Process 
WHERE Name LIKE 'DhaToolbox.exe%' )",
                   "IWbemServices::ExecQuery( Select Name from Win32_Process Where Name = 'EXCEL.EXE' )",
                   "IWbemServices::ExecQuery( Select * from Win32_Process Where Name = 'Outlook.exe' )",
                   "IWbemServices::ExecQuery( 
SELECT * 
FROM Win32_Process 
WHERE Name='wscript.exe' )",
                   "
SELECT * 
FROM Win32_Process 
WHERE NAME = \"mshta.exe\" 
AND CommandLine LIKE \"%DriverPack Notifier%relaunch%\"",
                   "IWbemServices::ExecQuery( 
SELECT * 
FROM Win32_Process 
WHERE Name LIKE '%Bginfo%' )",
                   "IWbemServices::ExecQuery( 
SELECT * 
FROM Win32_Process 
WHERE Name LIKE '%lspush.exe%' )") and
  user.id != "S-1-5-18" and
  not process.parent.executable :
                     ("C:\\Program Files\\Docker\\Docker\\frontend\\Docker Desktop.exe",
                      "C:\\Program Files\\Microsoft System Center\\Operations Manager\\Server\\MonitoringHost.exe",
                      "C:\\Windows\\System32\\gpscript.exe",
                      "C:\\Program Files (x86)\\Thomson Reuters\\Eikon\\Eikon.exe",
                      "C:\\Program Files (x86)\\Welcome\\Welcome.exe",
                      "C:\\Program Files\\ametiq\\ametiq siMed\\*.exe",
                      "C:\\Program Files (x86)\\PCMatic\\PCPitstopScheduleService.exe", 
                      "C:\\Users\\*\\AppData\\Roaming\\DriverPack Notifier\\DriverPackNotifier.exe")