(Image:\\cscript.exe OR OriginalFileName:cscript.exe) (CommandLine:winrm* CommandLine:invoke\ Create\ wmicimv2\/Win32_* CommandLine:\-r\:http*)