((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) CommandLine:\ \-e* (CommandLine:SQBuAHYAbwBrAGUALQ* OR CommandLine:kAbgB2AG8AawBlAC0A* OR CommandLine:JAG4AdgBvAGsAZQAtA* OR CommandLine:SW52b2tlL* OR CommandLine:ludm9rZS* OR CommandLine:JbnZva2Ut*)