(ParentImage:\\powershell.exe OR ParentImage:\\pwsh.exe) (Image:\\powershell.exe OR Image:\\pwsh.exe) (CommandLine:Get\-Content* CommandLine:\-Stream*)