(ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\mshta.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\schtasks.exe OR ParentImage:\\wmic.exe OR ParentImage:\\wscript.exe OR ParentImage:\\wsl.exe) (Image:\\msdt.exe OR OriginalFileName:msdt.exe)