(CommandLine:\\ShellIds\\Microsoft.PowerShell\\ExecutionPolicy* OR CommandLine:\\Policies\\Microsoft\\Windows\\PowerShell\\ExecutionPolicy*) (CommandLine:Bypass* OR CommandLine:RemoteSigned* OR CommandLine:Unrestricted*)