((ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe) Image:\\powershell.exe CommandLine:\ \-nologo\ \-windowstyle\ minimized\ \-file\ *) (CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\Windows\\Temp\\*)