((Image:\\mstsc.exe OR OriginalFileName:mstsc.exe) (CommandLine:.rdp OR CommandLine:.rdp\")) (-(ParentImage:C\:\\Windows\\System32\\lxss\\wslhost.exe CommandLine:C\:\\ProgramData\\Microsoft\\WSL\\wslg.rdp*))