((OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll) OR (Image:\\powershell.exe OR Image:\\pwsh.exe)) (CommandLine:Set\-Acl\ * CommandLine:\-AclObject\ * CommandLine:\-Path\ *)