((TargetObject:\\ShellIds\\Microsoft.PowerShell\\ExecutionPolicy OR TargetObject:\\Policies\\Microsoft\\Windows\\PowerShell\\ExecutionPolicy) (Details:Bypass* OR Details:Unrestricted*)) (-(Image:\:\\Windows\\System32\\* OR Image:\:\\Windows\\SysWOW64\\*))