ParentImage:\\PDQDeployRunner\-* ((Image:\\bash.exe OR Image:\\certutil.exe OR Image:\\cmd.exe OR Image:\\csc.exe OR Image:\\cscript.exe OR Image:\\dllhost.exe OR Image:\\mshta.exe OR Image:\\msiexec.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\scriptrunner.exe OR Image:\\wmic.exe OR Image:\\wscript.exe OR Image:\\wsl.exe) OR (Image:\:\\ProgramData\\* OR Image:\:\\Users\\Public\\* OR Image:\:\\Windows\\TEMP\\* OR Image:\\AppData\\Local\\Temp*) OR (CommandLine:\ \-decode\ * OR CommandLine:\ \-enc\ * OR CommandLine:\ \-encodedcommand\ * OR CommandLine:\ \-w\ hidden* OR CommandLine:DownloadString* OR CommandLine:FromBase64String* OR CommandLine:http* OR CommandLine:iex\ * OR CommandLine:Invoke\-*))