Data:ProviderName=WSMan* (-((Data:HostApplication=powershell* OR Data:HostApplication=C\:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell* OR Data:HostApplication=C\:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell* OR Data:HostApplication=C\:\/Windows\/System32\/WindowsPowerShell\/v1.0\/powershell* OR Data:HostApplication=C\:\/Windows\/SysWOW64\/WindowsPowerShell\/v1.0\/powershell*) OR Data:HostId=[a-zA-Z0-9-]{36}\\s+EngineVersion=)) (-Data:HostApplication=C\:\\Hexnode\\Hexnode\ Agent\\Current\\HexnodeAgent.exe*)