((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll) OR Description:Windows\ PowerShell OR Product:PowerShell\ Core\ 6) CommandLine:bxor* (CommandLine:ForEach* OR CommandLine:for\(* OR CommandLine:for\ * OR CommandLine:\-join\ * OR CommandLine:\-join'* OR CommandLine:\-join\"* OR CommandLine:\-join`* OR CommandLine:\:\:Join* OR CommandLine:\[char\]*)