(CommandLine:cmd.exe\ \/C\ whoami ParentImage:C\:\\Temp\\*) OR ((ParentImage:\\runonce.exe OR ParentImage:\\dllhost.exe) (CommandLine:cmd.exe\ \/c\ echo* CommandLine:>\ \\\\.\\pipe*)) OR ((ParentCommandLine:cmd.exe\ \/C\ echo* ParentCommandLine:\ >\ \\\\.\\pipe*) CommandLine:conhost.exe\ 0xffffffff\ \-ForceV1) OR (ParentCommandLine:\/C\ whoami CommandLine:conhost.exe\ 0xffffffff\ \-ForceV1)