((CommandLine:wmic* CommandLine:product\ where\ * CommandLine:call* CommandLine:uninstall* CommandLine:\/nointeractive*) OR ((CommandLine:wmic* CommandLine:caption\ like\ *) (CommandLine:call\ delete* OR CommandLine:call\ terminate*)) OR (CommandLine:process\ * CommandLine:where\ * CommandLine:delete*)) (CommandLine:%carbon%* OR CommandLine:%cylance%* OR CommandLine:%endpoint%* OR CommandLine:%eset%* OR CommandLine:%malware%* OR CommandLine:%Sophos%* OR CommandLine:%symantec%* OR CommandLine:Antivirus* OR CommandLine:AVG\ * OR CommandLine:Carbon\ Black* OR CommandLine:CarbonBlack* OR CommandLine:Cb\ Defense\ Sensor\ 64\-bit* OR CommandLine:Crowdstrike\ Sensor* OR CommandLine:Cylance\ * OR CommandLine:Dell\ Threat\ Defense* OR CommandLine:DLP\ Endpoint* OR CommandLine:Endpoint\ Detection* OR CommandLine:Endpoint\ Protection* OR CommandLine:Endpoint\ Security* OR CommandLine:Endpoint\ Sensor* OR CommandLine:ESET\ File\ Security* OR CommandLine:LogRhythm\ System\ Monitor\ Service* OR CommandLine:Malwarebytes* OR CommandLine:McAfee\ Agent* OR CommandLine:Microsoft\ Security\ Client* OR CommandLine:Sophos\ Anti\-Virus* OR CommandLine:Sophos\ AutoUpdate* OR CommandLine:Sophos\ Credential\ Store* OR CommandLine:Sophos\ Management\ Console* OR CommandLine:Sophos\ Management\ Database* OR CommandLine:Sophos\ Management\ Server* OR CommandLine:Sophos\ Remote\ Management\ System* OR CommandLine:Sophos\ Update\ Manager* OR CommandLine:Threat\ Protection* OR CommandLine:VirusScan* OR CommandLine:Webroot\ SecureAnywhere* OR CommandLine:Windows\ Defender*)