(((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\cmd.exe) (CommandLine:curl\ * OR CommandLine:Invoke\-RestMethod* OR CommandLine:Invoke\-WebRequest* OR CommandLine:irm\ * OR CommandLine:iwr\ * OR CommandLine:wget\ *) (CommandLine:\ \-ur* CommandLine:\ \-me* CommandLine:\ \-b* CommandLine:\ POST\ *)) OR ((Image:\\curl.exe CommandLine:\-\-ur*) (CommandLine:\ \-d\ * OR CommandLine:\ \-\-data\ *)) OR (Image:\\wget.exe (CommandLine:\-\-post\-data* OR CommandLine:\-\-post\-file*))) ((CommandLine:net\\s+view OR CommandLine:sc\\s+query) OR (CommandLine:Get\-Content* OR CommandLine:GetBytes* OR CommandLine:hostname* OR CommandLine:ifconfig* OR CommandLine:ipconfig* OR CommandLine:netstat* OR CommandLine:nltest* OR CommandLine:qprocess* OR CommandLine:systeminfo* OR CommandLine:tasklist* OR CommandLine:ToBase64String* OR CommandLine:whoami*) OR (CommandLine:type\ * CommandLine:\ >\ * CommandLine:\ C\:\\*))