((Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\powershell_ise.exe) OR (OriginalFileName:powershell.exe OR OriginalFileName:pwsh.dll OR OriginalFileName:powershell_ise.exe)) (CommandLine:New\-ADServiceAccount* CommandLine:\-CreateDelegatedServiceAccount* CommandLine:\-path*)