(ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe) Image:\\schtasks.exe (CommandLine:\/Create* CommandLine:powershell.exe\ \-NonI* CommandLine:\/TN\ Updater\ \/TR*) (CommandLine:\/SC\ ONLOGON* OR CommandLine:\/SC\ DAILY\ \/ST* OR CommandLine:\/SC\ ONIDLE* OR CommandLine:\/SC\ HOURLY*)