((Image:\\bash.exe OR Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\msbuild.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\sh.exe OR Image:\\wscript.exe) (TargetFilename:C\:\\PerfLogs\\* OR TargetFilename:C\:\\Users\\Public\\*)) OR ((Image:\\certutil.exe OR Image:\\forfiles.exe OR Image:\\mshta.exe OR Image:\\schtasks.exe OR Image:\\scriptrunner.exe OR Image:\\wmic.exe) (TargetFilename:C\:\\PerfLogs\\* OR TargetFilename:C\:\\Users\\Public\\* OR TargetFilename:C\:\\Windows\\Temp\\*))