(CommandLine:reg* CommandLine:add*) ((CommandLine:d\ 4* CommandLine:v\ Start*) (CommandLine:\\AppIDSvc* OR CommandLine:\\MsMpSvc* OR CommandLine:\\NisSrv* OR CommandLine:\\SecurityHealthService* OR CommandLine:\\Sense* OR CommandLine:\\UsoSvc* OR CommandLine:\\WdBoot* OR CommandLine:\\WdFilter* OR CommandLine:\\WdNisDrv* OR CommandLine:\\WdNisSvc* OR CommandLine:\\WinDefend* OR CommandLine:\\wscsvc* OR CommandLine:\\wuauserv*))