(GrandParentImage:\\rundll32.exe OR (ParentImage:\\SearchFilterHost.exe OR ParentImage:\\SearchProtocolHost.exe)) (CommandLine:ipconfig.exe\ \/all OR CommandLine:netstat.exe\ \-aon OR CommandLine:whoami.exe\ \/all)