((Image:\\WMIC.exe OR OriginalFileName:wmic.exe) CommandLine:process*) (-(CommandLine:call* CommandLine:create*))