(((Image:\\csrss.exe OR Image:\\lsass.exe OR Image:\\RuntimeBroker.exe OR Image:\\sihost.exe OR Image:\\smss.exe OR Image:\\wininit.exe OR Image:\\winlogon.exe) (TargetFilename:.bat OR TargetFilename:.dll OR TargetFilename:.exe OR TargetFilename:.hta OR TargetFilename:.iso OR TargetFilename:.ps1 OR TargetFilename:.txt OR TargetFilename:.vbe OR TargetFilename:.vbs)) OR ((Image:\\dllhost.exe OR Image:\\rundll32.exe OR Image:\\svchost.exe) (TargetFilename:.bat OR TargetFilename:.hta OR TargetFilename:.iso OR TargetFilename:.ps1 OR TargetFilename:.vbe OR TargetFilename:.vbs))) (-((Image:C\:\\Windows\\System32\\dllhost.exe (TargetFilename:\:\\Users\\* TargetFilename:\\AppData\\Local\\Temp\\__PSScriptPolicyTest_*) TargetFilename:.ps1) OR (Image:C\:\\Windows\\system32\\svchost.exe (TargetFilename:C\:\\Windows\\System32\\GroupPolicy\\DataStore\\* TargetFilename:\\sysvol\\* TargetFilename:\\Policies\\* TargetFilename:\\Machine\\Scripts\\Startup\\*) (TargetFilename:.ps1 OR TargetFilename:.bat)) OR (Image:C\:\\Windows\\system32\\svchost.exe (TargetFilename:C\:\\Program\ Files\\WindowsApps\\Clipchamp* TargetFilename:.ps1*)) OR ((Image:C\:\\Windows\\system32\\svchost.exe OR Image:C\:\\Windows\\SysWOW64\\svchost.exe) (TargetFilename:C\:\\Program\ Files\\WindowsApps\\Microsoft.PowerShellPreview* OR TargetFilename:C\:\\Program\ Files\ \(x86\)\\WindowsApps\\Microsoft.PowerShellPreview*) TargetFilename:.ps1)))