(Provider_Name:Service\ Control\ Manager EventID:7045) (ImagePath:\ \-c\ * OR ImagePath:\ \/c\ * OR ImagePath:\ –c\ * OR ImagePath:\ —c\ * OR ImagePath:\ ―c\ * OR ImagePath:\ \-r\ * OR ImagePath:\ \/r\ * OR ImagePath:\ –r\ * OR ImagePath:\ —r\ * OR ImagePath:\ ―r\ * OR ImagePath:\ \-k\ * OR ImagePath:\ \/k\ * OR ImagePath:\ –k\ * OR ImagePath:\ —k\ * OR ImagePath:\ ―k\ *) (ImagePath:cscript* OR ImagePath:mshta* OR ImagePath:powershell* OR ImagePath:pwsh* OR ImagePath:regsvr32* OR ImagePath:rundll32* OR ImagePath:wscript*)