((Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) (CommandLine:\ ONLOGON\ * OR CommandLine:\ ONSTART\ * OR CommandLine:\ ONCE\ * OR CommandLine:\ ONIDLE\ *)) (-(CommandLine:NT\ AUT* OR CommandLine:\ SYSTEM* OR CommandLine:HIGHEST*))