(EventID:104 Provider_Name:Microsoft\-Windows\-Eventlog) (-(Channel:Microsoft\-Windows\-PowerShell\/Operational OR Channel:Microsoft\-Windows\-Sysmon\/Operational OR Channel:PowerShellCore\/Operational OR Channel:Security OR Channel:System OR Channel:Windows\ PowerShell))