((Image:\\mshta.exe OR OriginalFileName:MSHTA.EXE) ((ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\regsvr32.exe OR ParentImage:\\rundll32.exe OR ParentImage:\\wscript.exe) (CommandLine:\\AppData\\Local\\* OR CommandLine:C\:\\ProgramData\\* OR CommandLine:C\:\\Users\\Public\\* OR CommandLine:C\:\\Windows\\Temp\\*))) OR ((Image:\\mshta.exe OR OriginalFileName:MSHTA.EXE) (-((Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SysWOW64\\*) OR (CommandLine:.htm* OR CommandLine:.hta*) OR (CommandLine:mshta.exe OR CommandLine:mshta))))