EventID:3 (processPath:\\powershell.exe OR processPath:\\pwsh.exe)