(Image:\\schtasks.exe CommandLine:\/Create\ *) (((CommandLine:\/sc\ minute\ * OR CommandLine:\/ru\ system\ *) (CommandLine:cmd\ \/c* OR CommandLine:cmd\ \/k* OR CommandLine:cmd\ \/r* OR CommandLine:cmd.exe\ \/c\ * OR CommandLine:cmd.exe\ \/k\ * OR CommandLine:cmd.exe\ \/r\ *)) OR (CommandLine:\ \-decode\ * OR CommandLine:\ \-enc\ * OR CommandLine:\ \-w\ hidden\ * OR CommandLine:\ bypass\ * OR CommandLine:\ IEX* OR CommandLine:.DownloadData* OR CommandLine:.DownloadFile* OR CommandLine:.DownloadString* OR CommandLine:\/c\ start\ \/min\ * OR CommandLine:FromBase64String* OR CommandLine:mshta\ http* OR CommandLine:mshta.exe\ http*) OR ((CommandLine:\:\\ProgramData\\* OR CommandLine:\:\\Temp\\* OR CommandLine:\:\\Tmp\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\AppData\\* OR CommandLine:%AppData%* OR CommandLine:%Temp%* OR CommandLine:%tmp%*) (CommandLine:cscript* OR CommandLine:curl* OR CommandLine:wscript*)))