CommandLine:winrm* ((CommandLine:format\:pretty* OR CommandLine:format\:\"pretty\"* OR CommandLine:format\:\"text\"* OR CommandLine:format\:text*) (-(Image:C\:\\Windows\\System32\\* OR Image:C\:\\Windows\\SysWOW64\\*)))