(TargetImage:\\cmd.exe OR TargetImage:\\powershell.exe OR TargetImage:\\pwsh.exe) (-(SourceImage:C\:\\Windows\\System32\\* OR SourceImage:C\:\\Windows\\SysWOW64\\* OR SourceImage:C\:\\Program\ Files\ \(x86\)\\* OR SourceImage:C\:\\Program\ Files\\*)) (-SourceImage:\\MsMpEng.exe)