((Image:\\cmd.exe CommandLine:copy\ *) OR ((Image:\\powershell.exe OR Image:\\pwsh.exe) (CommandLine:copy\-item* OR CommandLine:\ copy\ * OR CommandLine:cpi\ * OR CommandLine:\ cp\ *)) OR ((Image:\\robocopy.exe OR Image:\\xcopy.exe) OR (OriginalFileName:robocopy.exe OR OriginalFileName:XCOPY.EXE))) ((CommandLine:\\System32* OR CommandLine:\\SysWOW64* OR CommandLine:\\WinSxS*) (CommandLine:\\bitsadmin.exe* OR CommandLine:\\calc.exe* OR CommandLine:\\certutil.exe* OR CommandLine:\\cmdl32.exe* OR CommandLine:\\cscript.exe* OR CommandLine:\\mshta.exe* OR CommandLine:\\rundll32.exe* OR CommandLine:\\wscript.exe* OR CommandLine:\\ie4uinit.exe*))