((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:powershell.exe OR OriginalFileName:pwsh.dll)) (CommandLine:System.IdentityModel.Tokens.KerberosRequestorSecurityToken* CommandLine:.GetRequest\(\)*)