(ParentImage:\\wsusservice.exe OR (ParentImage:\\w3wp.exe ParentCommandLine:WsusPool*)) (Image:\\cmd.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\powershell_ise.exe)