EventID:4697 (ServiceFileName:powershell* OR ServiceFileName:pwsh*)