((ParentImage:\\cmd.exe OR ParentImage:\\cscript.exe OR ParentImage:\\curl.exe OR ParentImage:\\mshta.exe OR ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe OR ParentImage:\\wscript.exe) Image:\\rundll32.exe (CommandLine:\:\\ProgramData\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\AppData\\Roaming\\*)) (-CommandLine:.dll*)