process.executable.caseless:*\\schtasks.exe AND process.command_line:*\ \/create\ *
