CommandLine:cmd.exe\ \/Q\ \/c\ *\ 1>\ \\\\*\\*\\*\ 2>&1* OR CommandLine:cmd.exe\ \/C\ *\ >\ \\\\*\\*\\*\ 2>&1* OR CommandLine:cmd.exe\ \/C\ *\ >\ *\\Temp\\*\ 2>&1* OR CommandLine:powershell.exe\ \-exec\ bypass\ \-noni\ \-nop\ \-w\ 1\ \-C\ \"* OR CommandLine:powershell.exe\ \-noni\ \-nop\ \-w\ 1\ \-enc\ *