ParentImage:\\Velociraptor.exe ((CommandLine:code.exe* CommandLine:tunnel* CommandLine:\-\-accept\-server\-license\-terms*) OR (CommandLine:msiexec* CommandLine:\/i* CommandLine:http*) OR ((Image:\\powershell.exe OR Image:\\powershell_ise.exe OR Image:\\pwsh.exe) (CommandLine:Invoke\-WebRequest\ * OR CommandLine:IWR\ * OR CommandLine:.DownloadFile* OR CommandLine:.DownloadString*)))