(Image:\\WMIC.exe OR OriginalFileName:wmic.exe) ((CommandLine:\ volumename* OR CommandLine:\ logicaldisk*) OR (CommandLine:path* CommandLine:win32_logicaldisk*) OR (CommandLine:\ volume* CommandLine:\ list\ *))