ParentImage:\\wbem\\WmiPrvSE.exe ((Image:\\certutil.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\msiexec.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\verclsid.exe OR Image:\\wscript.exe) OR (Image:\\cmd.exe (CommandLine:cscript* OR CommandLine:mshta* OR CommandLine:powershell* OR CommandLine:pwsh* OR CommandLine:regsvr32* OR CommandLine:rundll32* OR CommandLine:wscript*))) (-(Image:\\WerFault.exe OR Image:\\WmiPrvSE.exe OR (Image:\\msiexec.exe CommandLine:\/i\ *)))