TargetObject:\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU* (((Details:powershell* OR Details:pwsh*) (Details:\ \-e\ * OR Details:\ \-ec\ * OR Details:\ \-en\ * OR Details:\ \-enc\ * OR Details:\ \-enco* OR Details:ftp* OR Details:Hidden* OR Details:http* OR Details:iex* OR Details:Invoke\-*)) OR (Details:wmic* (Details:shadowcopy* OR Details:process\ call\ create*)))