((OriginalFileName:wscript.exe OR OriginalFileName:cscript.exe) OR (Image:\\wscript.exe OR Image:\\cscript.exe)) (CommandLine:.js* OR CommandLine:.jse* OR CommandLine:.vba* OR CommandLine:.vbe* OR CommandLine:.vbs* OR CommandLine:.wsf* OR CommandLine:.wsh*)