(((Image:\\net.exe OR Image:\\net1.exe) OR (OriginalFileName:net.exe OR OriginalFileName:net1.exe)) (CommandLine:\/add* CommandLine:\/domain* CommandLine:ESX\ Admins* CommandLine:group*)) OR (((Image:\\PowerShell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.exe OR OriginalFileName:pwsh.dll)) (CommandLine:New\-ADGroup* CommandLine:ESX\ Admins*))