((Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) ((ParentImage:\\Windows\\Installer\\* ParentImage:msi*) ParentImage:tmp)