(((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+ OR CommandLine:\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{ OR CommandLine:\\^.*\\^.*\\^.*\\^.*\\^ OR CommandLine:`.*`.*`.*`.*`)) (-(ParentImage:C\:\\Program\ Files\\Amazon\\SSM\\ssm\-document\-worker.exe OR (CommandLine:new\ EventSource\(\"Microsoft.Windows.Sense.Client.Management\"* OR CommandLine:public\ static\ extern\ bool\ InstallELAMCertificateInfo\(SafeFileHandle\ handle\);*)))