(ParentImage:\\sqlservr.exe ParentCommandLine:VEEAMSQL*) (((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\wsl.exe OR Image:\\wt.exe) (CommandLine:\-ex\ * OR CommandLine:bypass* OR CommandLine:cscript* OR CommandLine:DownloadString* OR CommandLine:http\:\/\/* OR CommandLine:https\:\/\/* OR CommandLine:mshta* OR CommandLine:regsvr32* OR CommandLine:rundll32* OR CommandLine:wscript* OR CommandLine:copy\ *)) OR (Image:\\net.exe OR Image:\\net1.exe OR Image:\\netstat.exe OR Image:\\nltest.exe OR Image:\\ping.exe OR Image:\\tasklist.exe OR Image:\\whoami.exe))