((Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) (((CommandLine:ToInt* OR CommandLine:ToDecimal* OR CommandLine:ToByte* OR CommandLine:ToUint* OR CommandLine:ToSingle* OR CommandLine:ToSByte*) (CommandLine:ToChar* OR CommandLine:ToString* OR CommandLine:String*)) OR ((CommandLine:char* CommandLine:join*) OR (CommandLine:split* CommandLine:join*)))