((Image:\\Windows\\* (CommandLine:\\..\\Windows\\* OR CommandLine:\\..\\System32\\* OR CommandLine:\\..\\..\\*)) OR CommandLine:.exe\\..\\*) (-(CommandLine:\\Google\\Drive\\googledrivesync.exe\\..\\* OR CommandLine:\\Citrix\\Virtual\ Smart\ Card\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\..\\*))