((Image:\\curl.exe OR Image:\\wget.exe) OR (CommandLine:Invoke\-WebRequest* OR CommandLine:iwr\ * OR CommandLine:curl\ * OR CommandLine:wget\ * OR CommandLine:Start\-BitsTransfer* OR CommandLine:.DownloadFile\(* OR CommandLine:.DownloadString\(*)) (CommandLine:https\:\/\/attachment.outlook.live.net\/owa\/* OR CommandLine:https\:\/\/onenoteonlinesync.onenote.com\/onenoteonlinesync\/*)