(ParentImage:\\WebHelpDesk\\bin\\* (ParentImage:\\java.exe OR ParentImage:\\javaw.exe) ParentCommandLine:tomcat*) (CommandLine:\-enc* OR CommandLine:base64* OR CommandLine:bitsadmin* OR CommandLine:certutil* OR CommandLine:curl* OR CommandLine:Invoke\-RestMethod* OR CommandLine:Invoke\-WebRequest* OR CommandLine:irm\ * OR CommandLine:iwr\ * OR CommandLine:mshta* OR CommandLine:msiexec* OR CommandLine:Net.WebClient* OR CommandLine:Start\-BitsTransfer* OR CommandLine:wget* OR CommandLine:wmic*)