(OriginalFileName:wmic.exe OR Image:\\WMIC.exe) ((CommandLine:\ service\ * CommandLine:\ call\ *) (CommandLine:stopservice* OR CommandLine:startservice*))