((ParentImage:\\mshta.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\cscript.exe OR ParentImage:\\wscript.exe OR ParentImage:\\wmiprvse.exe OR ParentImage:\\regsvr32.exe) (Image:\\schtasks.exe OR Image:\\nslookup.exe OR Image:\\certutil.exe OR Image:\\bitsadmin.exe OR Image:\\mshta.exe)) (-(CurrentDirectory:\\ccmcache\\* OR (ParentCommandLine:\\Program\ Files\\Amazon\\WorkSpacesConfig\\Scripts\\setup\-scheduledtask.ps1* OR ParentCommandLine:\\Program\ Files\\Amazon\\WorkSpacesConfig\\Scripts\\set\-selfhealing.ps1* OR ParentCommandLine:\\Program\ Files\\Amazon\\WorkSpacesConfig\\Scripts\\check\-workspacehealth.ps1* OR ParentCommandLine:\\nessus_*) OR CommandLine:\\nessus_* OR (ParentImage:\\mshta.exe Image:\\mshta.exe (ParentCommandLine:C\:\\MEM_Configmgr_* ParentCommandLine:\\splash.hta* ParentCommandLine:\{1E460BD7\-F1C3\-4B2E\-88BF\-4E770A288AF5\}*) (CommandLine:C\:\\MEM_Configmgr_* CommandLine:\\SMSSETUP\\BIN\\* CommandLine:\\autorun.hta* CommandLine:\{1E460BD7\-F1C3\-4B2E\-88BF\-4E770A288AF5\}*))))