((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:fsutil* CommandLine:behavior* CommandLine:set* CommandLine:SymlinkEvaluation*) (CommandLine:R2L\:1* OR CommandLine:R2R\:1* OR CommandLine:L2L\:1*)