((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (CommandLine:Import\-Module\ * OR CommandLine:ipmo\ *) CommandLine:Microsoft.ActiveDirectory.Management.dll*