(ParentImage:\\TieringEngineService.exe Image:\\conhost.exe CommandLine:conhost.exe\" (User:AUTHORI* OR User:AUTORI* OR User:$*)) OR (GrandParentImage:\\TieringEngineService.exe ParentImage:\\conhost.exe (Image:\\cmd.exe OR Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) (User:AUTHORI* OR User:AUTORI* OR User:$*))