((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) ((CommandLine:Get\-ADUser\ * CommandLine:\ \-Filter\ \**) (CommandLine:\ >\ * OR CommandLine:\ |\ Select\ * OR CommandLine:Out\-File* OR CommandLine:Set\-Content* OR CommandLine:Add\-Content*))