ParentImage:\\gup.exe ((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\cscript.exe OR Image:\\wscript.exe OR Image:\\mshta.exe) OR (CommandLine:bitsadmin* OR CommandLine:certutil* OR CommandLine:curl* OR CommandLine:finger* OR CommandLine:forfiles* OR CommandLine:regsvr32* OR CommandLine:rundll32* OR CommandLine:wget*))