(Image:\\cscript.exe CommandLine:.vbs\ \/shell\ *) OR (CommandLine:csvde\ \-f\ C\:\\windows\\web\\* CommandLine:.log*)