Windows Script Execution from Archive File

process where event.action == "start" and
 user.id like ("S-1-5-21*", "S-1-12-*") and process.name : "wscript.exe" and
 (
   /* execution from archive temp file */
   process.args : ("?:\\Users\\*\\Temp\\7z*", "?:\\Users\\*\\Temp\\Rar$*", "?:\\Users\\*\\Temp\\Temp?_*") or

  /* execution from mounted ISO or IMG  */
   (process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and process.working_directory : "?:\\" and
    not process.args : "?:\\Windows\\System32\\winrm.vbs" and not process.working_directory : "C:\\")
  ) and
  not (process.name : "cscript.exe" and process.command_line : "cscript  C:\\splitwindow.vbs" and
      process.parent.args : "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.bat") and
  not (process.args : "?:\\Program Files\\nodejs" and process.args : "rmdir" and process.name : "wscript.exe") and
  not process.command_line :
              ("\"wscript.exe\" pbcdstart.vbs",
               "cscript  C:\\splitwindow.vbs",
               "\"C:\\WINDOWS\\System32\\WScript.exe\" \"D:\\CargaExpedientesProd.vbs\" ")