((Image:\\CVE\-202* OR Image:\\CVE202*) OR (Image:\\poc.exe OR Image:\\artifact.exe OR Image:\\artifact64.exe OR Image:\\artifact_protected.exe OR Image:\\artifact32.exe OR Image:\\artifact32big.exe OR Image:obfuscated.exe OR Image:obfusc.exe OR Image:\\meterpreter)) OR (CommandLine:inject.ps1* OR CommandLine:Invoke\-CVE* OR CommandLine:pupy.ps1* OR CommandLine:payload.ps1* OR CommandLine:beacon.ps1* OR CommandLine:PowerView.ps1* OR CommandLine:bypass.ps1* OR CommandLine:obfuscated.ps1* OR CommandLine:obfusc.ps1* OR CommandLine:obfus.ps1* OR CommandLine:obfs.ps1* OR CommandLine:evil.ps1* OR CommandLine:MiniDogz.ps1* OR CommandLine:_enc.ps1* OR CommandLine:\\shell.ps1* OR CommandLine:\\rshell.ps1* OR CommandLine:revshell.ps1* OR CommandLine:\\av.ps1* OR CommandLine:\\av_test.ps1* OR CommandLine:adrecon.ps1* OR CommandLine:mimikatz.ps1* OR CommandLine:\\PowerUp_* OR CommandLine:powerup.ps1* OR CommandLine:\\Temp\\a.ps1* OR CommandLine:\\Temp\\p.ps1* OR CommandLine:\\Temp\\1.ps1* OR CommandLine:Hound.ps1* OR CommandLine:encode.ps1* OR CommandLine:powercat.ps1*)