(CommandLine:vbscript\:Close\(Execute\(\"CreateObject\(* CommandLine:powershell* CommandLine:\-w\ 1\ \-exec\ Bypass* CommandLine:\\ProgramData\\*) OR (CommandLine:Win32_OperatingSystem* CommandLine:Win32_NetworkAdapterConfiguration* CommandLine:root\\SecurityCenter2* CommandLine:\[System.Net.DNS\]*) OR (CommandLine:\[Convert\]\:\:ToBase64String* CommandLine:\[System.Text.Encoding\]\:\:UTF8.GetString\]* CommandLine:GetResponse\(\).GetResponseStream\(\)* CommandLine:\[System.Net.HttpWebRequest\]\:\:Create\(* CommandLine:\-bxor\ *)