(ScriptBlockText:get\-localgroup\ * OR ScriptBlockText:get\-localgroupmember\ *) OR ((ScriptBlockText:get\-wmiobject\ * OR ScriptBlockText:gwmi\ * OR ScriptBlockText:get\-ciminstance\ * OR ScriptBlockText:gcim\ *) ScriptBlockText:win32_group*)