ParentImage:\\crushftp.exe (((Image:\\powershell.exe OR Image:\\powershell_ise.exe OR Image:\\pwsh.exe) (CommandLine:IEX* CommandLine:enc* CommandLine:Hidden* CommandLine:bypass*)) OR (Image:\\cmd.exe (CommandLine:\/c\ powershell* OR CommandLine:whoami* OR CommandLine:net.exe* OR CommandLine:net1.exe*)) OR (Image:\\bitsadmin.exe OR Image:\\certutil.exe OR Image:\\mshta.exe OR Image:\\cscript.exe OR Image:\\wscript.exe))