ParentImage:C\:\\Program\ Files\\WindowsApps\\* ((Image:\\cmd.exe OR Image:\\cscript.exe OR Image:\\mshta.exe OR Image:\\powershell.exe OR Image:\\powershell_ise.exe OR Image:\\pwsh.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wscript.exe) OR (CommandLine:cmd\ \/c* OR CommandLine:Invoke\-* OR CommandLine:Base64*)) (-((ParentImage:\:\\Program\ Files\\WindowsApps\\Microsoft.WindowsTerminal* ParentImage:\\WindowsTerminal.exe (Image:\\powershell.exe OR Image:\\cmd.exe OR Image:\\pwsh.exe)) OR (ParentImage:C\:\\Program\ Files\\WindowsApps\\Microsoft.SysinternalsSuite* Image:\\cmd.exe)))