(ParentImage:\\cmd.exe OR ParentImage:\\explorer.exe OR ParentImage:\\powershell.exe) (Image:\\cmd.exe OR Image:\\powershell.exe) (CommandLine:findstr* CommandLine:.vbs* CommandLine:.lnk*)