(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) CommandLine:\ \/create\ * (CommandLine:powershell* OR CommandLine:pwsh* OR CommandLine:cmd\ \/c\ * OR CommandLine:cmd\ \/k\ * OR CommandLine:cmd\ \/r\ * OR CommandLine:cmd.exe\ \/c\ * OR CommandLine:cmd.exe\ \/k\ * OR CommandLine:cmd.exe\ \/r\ *) (CommandLine:C\:\\ProgramData\\* OR CommandLine:%ProgramData%*)