((Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wscript.exe) OR (ParentImage:\\cscript.exe OR ParentImage:\\mshta.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\wscript.exe)) (TargetFilename:.docm OR TargetFilename:.dotm OR TargetFilename:.xlsm OR TargetFilename:.xltm OR TargetFilename:.potm OR TargetFilename:.pptm)