((Image:\\Sysmon64.exe OR Image:\\Sysmon.exe) OR Description:System\ activity\ monitor) (CommandLine:\-c* OR CommandLine:\/c* OR CommandLine:–c* OR CommandLine:—c* OR CommandLine:―c*)