LoFP / some installers might generate a similar behavior. an initial baseline is required

condition: all of selection_*
selection_exec:
  Image|endswith:
  - \wscript.exe
  - \cscript.exe
  - \mshta.exe
selection_ext:
  CommandLine|contains:
  - .hta
  - .js
  - .jse
  - .vba
  - .vbe
  - .vbs
  - .wsf
  - .wsh
selection_paths:
  CommandLine|contains:
  - :\Perflogs\
  - :\Temp\
  - :\Tmp\
  - :\Users\Public\
  - :\Windows\Temp\
  - \AppData\Local\Temp\
  - \AppData\Roaming\Temp\
  - \Start Menu\Programs\Startup\
  - \Temporary Internet
  - \Windows\Temp
  - '%LocalAppData%\Temp\'
  - '%TEMP%'
  - '%TMP%'