((Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\cmd.exe) (ParentCommandLine:MsiExec.exe* ParentCommandLine:\-Embedding\ *)) (-((Image:\:\\Windows\\System32\\cmd.exe CommandLine:C\:\\Program\ Files\\SplunkUniversalForwarder\\bin\\*) OR (CommandLine:\\DismFoDInstall.cmd* OR (ParentCommandLine:\\MsiExec.exe\ \-Embedding\ * ParentCommandLine:Global\\MSI0000*))))