((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (-((ParentImage:\:\\Windows\\explorer.exe OR ParentImage:\:\\Windows\\System32\\CompatTelRunner.exe OR ParentImage:\:\\Windows\\SysWOW64\\explorer.exe) OR ParentImage:\:\\$WINDOWS.\~BT\\Sources\\SetupHost.exe)) (-((ParentImage:\\AppData\\Local\\Programs\\Microsoft\ VS\ Code\\Code.exe ParentCommandLine:\ \-\-ms\-enable\-electron\-run\-as\-node\ *) OR (ParentImage:\:\\Program\ Files\\WindowsApps\\Microsoft.WindowsTerminal_* ParentImage:\\WindowsTerminal.exe) OR ParentImage:\:\\Program\ Files\\Windows\ Defender\ Advanced\ Threat\ Protection\\SenseIR.exe))