ParentImage:\:\\Users\\Public\\* ((Image:\\bitsadmin.exe OR Image:\\certutil.exe OR Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wscript.exe) OR (CommandLine:bitsadmin* OR CommandLine:certutil* OR CommandLine:cscript* OR CommandLine:mshta* OR CommandLine:powershell* OR CommandLine:regsvr32* OR CommandLine:rundll32* OR CommandLine:wscript*))