((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:powershell_ise.EXE OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:curl\ * OR CommandLine:Invoke\-RestMethod* OR CommandLine:Invoke\-WebRequest* OR CommandLine:\ irm\ * OR CommandLine:iwr\ * OR CommandLine:wget\ *) (CommandLine:\:\/\/1* OR CommandLine:\:\/\/2* OR CommandLine:\:\/\/3* OR CommandLine:\:\/\/4* OR CommandLine:\:\/\/5* OR CommandLine:\:\/\/6* OR CommandLine:\:\/\/7* OR CommandLine:\:\/\/8* OR CommandLine:\:\/\/9*)