((Image:\\powershell.exe OR Image:\\pwsh.exe) Initiated:true) (-(((DestinationIp:127.* OR DestinationIp:10.* OR DestinationIp:169.254.* OR DestinationIp:172.16.* OR DestinationIp:172.17.* OR DestinationIp:172.18.* OR DestinationIp:172.19.* OR DestinationIp:172.20.* OR DestinationIp:172.21.* OR DestinationIp:172.22.* OR DestinationIp:172.23.* OR DestinationIp:172.24.* OR DestinationIp:172.25.* OR DestinationIp:172.26.* OR DestinationIp:172.27.* OR DestinationIp:172.28.* OR DestinationIp:172.29.* OR DestinationIp:172.30.* OR DestinationIp:172.31.* OR DestinationIp:192.168.* OR DestinationIp:\:\:1\/128 OR DestinationIp:fe8* OR DestinationIp:fe9* OR DestinationIp:fea* OR DestinationIp:feb* OR DestinationIp:fc* OR DestinationIp:fd*) (User:AUTHORI* OR User:AUTORI*)) OR (DestinationIp:20.184.* OR DestinationIp:20.185.* OR DestinationIp:20.186.* OR DestinationIp:20.187.* OR DestinationIp:20.188.* OR DestinationIp:20.189.* OR DestinationIp:20.190.* OR DestinationIp:20.191.* OR DestinationIp:51.103.210.* OR DestinationIp:51.103.211.*)))