(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) (CommandLine:\-disable* OR CommandLine:\/disable* OR CommandLine:–disable* OR CommandLine:—disable* OR CommandLine:―disable*) (CommandLine:\\Windows\\BitLocker* OR CommandLine:\\Windows\\ExploitGuard* OR CommandLine:\\Windows\\ExploitGuard\\ExploitGuard\ MDM\ policy\ Refresh* OR CommandLine:\\Windows\\SystemRestore\\SR* OR CommandLine:\\Windows\\UpdateOrchestrator\\* OR CommandLine:\\Windows\\Windows\ Defender\\* OR CommandLine:\\Windows\\WindowsBackup\\* OR CommandLine:\\Windows\\WindowsUpdate\\*)