LoFP / some installers might generate a similar behavior. an initial baseline is required

condition: all of selection_*
selection_exec:
  Image|endswith:
  - \wscript.exe
  - \cscript.exe
selection_ext:
  CommandLine|contains:
  - .js
  - .jse
  - .vba
  - .vbe
  - .vbs
  - .wsf
selection_paths:
  CommandLine|contains:
  - :\Temp\
  - :\Tmp\
  - :\Users\Public\
  - :\Windows\Temp\
  - \AppData\Local\Temp\