ParentImage:\\services.exe (((CommandLine:\/c* CommandLine:echo* CommandLine:\\pipe\\*) (CommandLine:cmd* OR CommandLine:%COMSPEC%*)) OR (CommandLine:rundll32* CommandLine:.dll,a* CommandLine:\/p\:*)) (-CommandLine:MpCmdRun*)