((Image:\\cmd.exe OR Image:\\powershell.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE)) (CommandLine:echo* CommandLine:>* CommandLine:\\\\.\\pipe\\*)