Network Activity to a Suspicious Top Level Domain

network where host.os.type == "windows" and dns.question.name != null and
 (
  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
                  "bitsadmin.exe", "InstallUtil.exe", "python.exe", "regsvr32.exe", "dllhost.exe", "node.exe", "curl.exe",
                  "java.exe", "javaw.exe", "*.pif", "*.com", "*.scr") or
  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
  ?process.executable : (
    "?:\\Users\\Public\\*.exe", "?:\\ProgramData\\*.exe", "?:\\Users\\*\\Downloads\\*.exe",
    "\\Device\\HarddiskVolume*\\Users\\Public\\*.exe", "\\Device\\HarddiskVolume*\\ProgramData\\*.exe", "\\Device\\HarddiskVolume*\\Users\\*\\Downloads\\*.exe"
  )
 ) and
dns.question.name regex """.*\.(top
| buzz
| xyz
| rest
| ml
| cf
| gq
| ga
| onion
| monster
| cyou
| quest
| cc
| bar
| cfd
| click
| cam
| surf
| tk
| shop
| club
| icu
| pw
| ws
| online
| fun
| life
| boats
| store
| hair
| skin
| motorcycles
| christmas
| lol
| makeup
| mom
| bond
| beauty
| biz
| live
| work
| zip
| country
| accountant
| date
| party
| science
| loan
| win
| men
| faith
| review
| racing
| download
| host
| zone)""" and

not process.executable : (
    "?:\\ProgramData\\Microsoft\\Windows Defender\\platform\\*\\*.exe",
    "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\platform\\*\\*.exe"
)