Execution from Unusual Directory - Command Line

process where event.type in ("start", "process_started", "info") and
process.name : ("wscript.exe","cscript.exe","rundll32.exe","regsvr32.e
xe","cmstp.exe","RegAsm.exe","installutil.exe","mshta.exe","RegSvcs.ex
e") and /* add suspicious execution paths here */ process.args : ("C:
\\PerfLogs\\*","C:\\Users\\Public\\*","C:\\Users\\Default\\*","C:\\Win
dows\\Tasks\\*","C:\\Intel\\*", "C:\\AMD\\Temp\\*",
"C:\\Windows\\AppReadiness\\*", "C:\\Windows\\ServiceState\\*","C:\\Wi
ndows\\security\\*","C:\\Windows\\IdentityCRL\\*","C:\\Windows\\Brandi
ng\\*","C:\\Windows\\csc\\*",
"C:\\Windows\\DigitalLocker\\*","C:\\Windows\\en-US\\*","C:\\Windows\\
wlansvc\\*","C:\\Windows\\Prefetch\\*","C:\\Windows\\Fonts\\*", "C:\\
Windows\\diagnostics\\*","C:\\Windows\\TAPI\\*","C:\\Windows\\INF\\*",
"C:\\Windows\\System32\\Speech\\*","C:\\windows\\tracing\\*", "c:\\wi
ndows\\IME\\*","c:\\Windows\\Performance\\*","c:\\windows\\intel\\*","
c:\\windows\\ms\\*","C:\\Windows\\dot3svc\\*","C:\\Windows\\ServicePro
files\\*", "C:\\Windows\\panther\\*","C:\\Windows\\RemotePackages\\*"
,"C:\\Windows\\OCR\\*","C:\\Windows\\appcompat\\*","C:\\Windows\\apppa
tch\\*","C:\\Windows\\addins\\*", "C:\\Windows\\Setup\\*","C:\\Window
s\\Help\\*","C:\\Windows\\SKB\\*","C:\\Windows\\Vss\\*","C:\\Windows\\
Web\\*","C:\\Windows\\servicing\\*","C:\\Windows\\CbsTemp\\*", "C:\\W
indows\\Logs\\*","C:\\Windows\\WaaS\\*","C:\\Windows\\twain_32\\*","C:
\\Windows\\ShellExperiences\\*","C:\\Windows\\ShellComponents\\*","C:\
\Windows\\PLA\\*", "C:\\Windows\\Migration\\*","C:\\Windows\\debug\\*
","C:\\Windows\\Cursors\\*","C:\\Windows\\Containers\\*","C:\\Windows\
\Boot\\*","C:\\Windows\\bcastdvr\\*", "C:\\Windows\\assembly\\*","C:\
\Windows\\TextInput\\*","C:\\Windows\\security\\*","C:\\Windows\\schem
as\\*","C:\\Windows\\SchCache\\*","C:\\Windows\\Resources\\*", "C:\\W
indows\\rescache\\*","C:\\Windows\\Provisioning\\*","C:\\Windows\\Prin
tDialog\\*","C:\\Windows\\PolicyDefinitions\\*","C:\\Windows\\media\\*
", "C:\\Windows\\Globalization\\*","C:\\Windows\\L2Schemas\\*","C:\\W
indows\\LiveKernelReports\\*","C:\\Windows\\ModemLogs\\*","C:\\Windows
\\ImmersiveControlPanel\\*")