(((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:hctac* OR CommandLine:kaerb* OR CommandLine:dnammoc* OR CommandLine:ekovn* OR CommandLine:eliFd* OR CommandLine:rahc* OR CommandLine:etirw* OR CommandLine:golon* OR CommandLine:tninon* OR CommandLine:eddih* OR CommandLine:tpircS* OR CommandLine:ssecorp* OR CommandLine:llehsrewop* OR CommandLine:esnopser* OR CommandLine:daolnwod* OR CommandLine:tneilCbeW* OR CommandLine:tneilc* OR CommandLine:ptth* OR CommandLine:elifotevas* OR CommandLine:46esab* OR CommandLine:htaPpmeTteG* OR CommandLine:tcejbO* OR CommandLine:maerts* OR CommandLine:hcaerof* OR CommandLine:retupmoc*)) (-(CommandLine:\ \-EncodedCommand\ * OR CommandLine:\ \-enc\ *))