(ParentImage:\\WINWORD.EXE OR ParentImage:\\EXCEL.EXE OR ParentImage:\\POWERPNT.exe OR ParentImage:\\MSPUB.exe OR ParentImage:\\VISIO.exe OR ParentImage:\\MSACCESS.EXE OR ParentImage:\\EQNEDT32.EXE OR ParentImage:\\ONENOTE.EXE OR ParentImage:\\wordpad.exe OR ParentImage:\\wordview.exe) (Image:\\wbem\\WMIC.exe OR OriginalFileName:wmic.exe) ((CommandLine:process* CommandLine:create* CommandLine:call*) (CommandLine:regsvr32* OR CommandLine:rundll32* OR CommandLine:msiexec* OR CommandLine:mshta* OR CommandLine:verclsid* OR CommandLine:wscript* OR CommandLine:cscript*))