(ParentImage:\\ArcSOC.exe (Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wmic.exe OR Image:\\wscript.exe)) (-(Image:\\cmd.exe CommandLine:cmd.exe\ \/c\ \"ver\"))