(((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:Import\-Module\ * OR CommandLine:ipmo\ *)) (-((ParentImage:\:\\Program\ Files\\WindowsApps\\Microsoft.WindowsTerminal_* OR ParentImage:\:\\Windows\\System32\\cmd.exe*) (CommandLine:\:\\Program\ Files\\Microsoft\ Visual\ Studio\\* CommandLine:Tools\\Microsoft.VisualStudio.DevShell.dll*)))