(Description:WMI\ Commandline\ Utility OR OriginalFileName:wmic.exe OR Image:\\WMIC.exe) (CommandLine:LOGICALDISK\ get\ Name,Size,FreeSpace* OR CommandLine:os\ get\ Caption,OSArchitecture,Version*)