ParentImage:\\winlogon.exe (Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wscript.exe OR Image:\\wt.exe) (CommandLine:sethc.exe* OR CommandLine:utilman.exe* OR CommandLine:osk.exe* OR CommandLine:Magnify.exe* OR CommandLine:Narrator.exe* OR CommandLine:DisplaySwitch.exe*)