((Image:\\wsl.exe OR OriginalFileName:wsl.exe) (CommandLine:\ \-e\ * OR CommandLine:\ \-\-exec* OR CommandLine:\ \-\-system* OR CommandLine:\ \-\-shell\-type\ * OR CommandLine:\ \/mnt\/c* OR CommandLine:\ \-\-user\ root* OR CommandLine:\ \-u\ root* OR CommandLine:\-\-debug\-shell*)) (-(ParentImage:\\cmd.exe (CommandLine:\ \-d\ * CommandLine:\ \-e\ kill\ *)))