(Image:\\powershell.exe OR Image:\\pwsh.exe) CommandLine:\\s-\\s*<