(Description:Execute\ processes\ remotely OR Product:Sysinternals\ PsExec OR (Description:Windows\ PowerShell* OR Description:pwsh*) OR (OriginalFileName:certutil.exe OR OriginalFileName:cmstp.exe OR OriginalFileName:cscript.exe OR OriginalFileName:IE4UINIT.EXE OR OriginalFileName:finger.exe OR OriginalFileName:mshta.exe OR OriginalFileName:msiexec.exe OR OriginalFileName:msxsl.exe OR OriginalFileName:powershell_ise.exe OR OriginalFileName:powershell.exe OR OriginalFileName:psexec.c OR OriginalFileName:psexec.exe OR OriginalFileName:psexesvc.exe OR OriginalFileName:pwsh.dll OR OriginalFileName:reg.exe OR OriginalFileName:regsvr32.exe OR OriginalFileName:rundll32.exe OR OriginalFileName:WerMgr OR OriginalFileName:wmic.exe OR OriginalFileName:wscript.exe)) (-(Image:\\certutil.exe OR Image:\\cmstp.exe OR Image:\\cscript.exe OR Image:\\ie4uinit.exe OR Image:\\finger.exe OR Image:\\mshta.exe OR Image:\\msiexec.exe OR Image:\\msxsl.exe OR Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\psexec.exe OR Image:\\psexec64.exe OR Image:\\PSEXESVC.exe OR Image:\\pwsh.exe OR Image:\\reg.exe OR Image:\\regsvr32.exe OR Image:\\rundll32.exe OR Image:\\wermgr.exe OR Image:\\wmic.exe OR Image:\\wscript.exe))