((ParentImage:\\7z*.exe CommandLine:\\AppData\\local\\temp\\7z*\\*) OR (ParentImage:\\winrar.exe CommandLine:\\AppData\\local\\temp\\rar*\\*) OR (ParentImage:\\explorer.exe (CommandLine:\\AppData\\local\\temp\*.rar\\* OR CommandLine:\\AppData\\local\\temp\*.zip\\*))) ((Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\wscript.exe) (CommandLine:.hta OR CommandLine:.js OR CommandLine:.jse OR CommandLine:.ps1 OR CommandLine:.vbe OR CommandLine:.vbs OR CommandLine:.wsf OR CommandLine:.wsh))