((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (ParentImage:\\elevation_service.exe (IntegrityLevel:System OR IntegrityLevel:S\-1\-16\-16384))