((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) CommandLine:System.Security.Cryptography.* (CommandLine:.AesCryptoServiceProvider* OR CommandLine:.DESCryptoServiceProvider* OR CommandLine:.DSACryptoServiceProvider* OR CommandLine:.RC2CryptoServiceProvider* OR CommandLine:.Rijndael* OR CommandLine:.RSACryptoServiceProvider* OR CommandLine:.TripleDESCryptoServiceProvider*)