((Image:\\AgentExecutor.exe OR OriginalFileName:AgentExecutor.exe) (CommandLine:\ \-powershell* OR CommandLine:\ \-remediationScript*)) (-((CommandLine:C\:\\Windows\\System32\\WindowsPowerShell\\v1.0\\* OR CommandLine:C\:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\*) OR ParentImage:\\Microsoft.Management.Services.IntuneWindowsAgent.exe))