LoFP / igfxcuiservice.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxcuiservice.exe is the parent of the cmd.exe)

condition: all of selection_* and not 1 of filter_*
filter_intel:
  CommandLine: +R +H +S +A \\\*.cui
  ParentCommandLine: C:\\WINDOWS\\system32\\\*.bat
  ParentImage|endswith: \cmd.exe
filter_msiexec:
  CommandLine|contains: '\desktop.ini '
selection_cli:
  CommandLine|contains: ' +h '
selection_img:
- Image|endswith: \attrib.exe
- OriginalFileName: ATTRIB.EXE