Command and Scripting Interpreter via Windows Scripts

process where host.os.type == "windows" and event.type == "start" and
  process.command_line != null and
  (
    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe", "cmd.exe") or
    ?process.pe.original_file_name : ("powershell.exe", "pwsh.dll", "powershell_ise.exe", "Cmd.Exe")
  ) and
  process.parent.name : ("wscript.exe", "mshta.exe") and
  not (
    process.args : (
      "C:\\Program Files\\Intel\\SUR\\QUEENCREEK\\x64\\task.bat",
      "\"C:\\Program Files\\Intel\\SUR\\QUEENCREEK\\x64\\task.bat\""
    ) or
    process.command_line : (
      "\"C:\\Windows\\system32\\cmd.exe\" /c auditpol.exe /set /SUBCATEGORY:*",
      "\"C:\\Windows\\system32\\cmd.exe\" /c auditpol.exe /get*",
      "\"C:\\Windows\\system32\\cmd.exe\" /c exit\""
    ) or
    (process.args == "-File" and process.args == "-ExecutionPolicy")
  )
  and 
  not (
    ?user.id == "S-1-5-18" and
    /* Don't apply the user.id exclusion to Sysmon for compatibility */
    not data_stream.dataset : ("windows.sysmon_operational", "windows.sysmon")
  )