((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:powershell_ise.EXE OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:curl\ * OR CommandLine:Invoke\-WebRequest* OR CommandLine:iwr\ * OR CommandLine:wget\ *) (CommandLine:\ \-ur* OR CommandLine:\ \-o*) (CommandLine:\\AppData\\* OR CommandLine:\\Desktop\\* OR CommandLine:\\Temp\\* OR CommandLine:\\Users\\Public\\* OR CommandLine:%AppData%* OR CommandLine:%Public%* OR CommandLine:%Temp%* OR CommandLine:%tmp%* OR CommandLine:\:\\Windows\\*)