Suspicious XPC Service Child Process

process where event.type == "start" and process.parent.name : "com.*" and 
    ((process.name in ("bash", "sh", "zsh") and process.args == "-c") or
    process.name like~ ("curl", "nscurl", "osascript", "python*", "tclsh*")) and not
    process.executable like "/Applications/*" and not 
    process.parent.executable like~ 
                                ("/Applications/*", 
                                 "/Library/PrivilegedHelperTools/*", 
                                 "/System/*", 
                                 "/private/var/db/com.apple.xpc.*", 
                                 "/private/var/folders/*/*/*/AppTranslocation/*",
                                 "/Library/Application Support/AvastHUB/com.avast.hub.app/Contents/Helpers/com.avast.hub.worker",
                                 "/Library/Application Support/Symantec/Silo/MES/LiveUpdate/com.symantec.SymLUHelper",
                                 "/Library/Application Support/Symantec/Silo/NFM/LiveUpdate/com.symantec.SymLUHelper",
                                 "/Library/Application Support/AvastSecureLine/components/update/com.avast.osx.secureline.update-agent",
                                 "/Library/Application Support/CatoNetworks/com.catonetworks.mac.CatoClient.helper.app/Contents/MacOS/com.catonetworks.mac.CatoClient.helper",
                                 "/usr/libexec/*", 
                                 "/Library/SystemExtensions/*") and not 
    process.parent.name like~ ("com.docker.*", "com.todyl.SGNWatchDog") and not
    process.command_line like~ ("sh -c /bin/cp /Library/Preferences/SystemConfiguration/preferences.plist /Library/Preferences/SystemConfiguration/preferences.plist.old",
                               "/bin/sh -c git-upload-pack*", "*sh -c */Library/Application Support/HmaProVpn/hub/userinit.sh*") and 
    not process.Ext.effective_parent.executable == "/Library/Application Support/PasswordManager/com.trendmicro.consumer.pwmsvc" and
    not (process.parent.code_signature.trusted == true and process.parent.code_signature.exists == true) and
    not (
      process.parent.executable == "/Library/AppQuest/com.apple.questd" and
      process.Ext.effective_parent.executable == "/usr/bin/sudo"
    )