((Image:\\WMIC.exe OR OriginalFileName:wmic.exe) CommandLine:service*) (-(CommandLine:Change* OR CommandLine:Create* OR CommandLine:Delete* OR CommandLine:PauseService* OR CommandLine:ResumeService* OR CommandLine:SetSecurityDescriptor* OR CommandLine:StartService* OR CommandLine:StopService* OR CommandLine:UserControlService*))