(SourceImage:\\powershell.exe OR SourceImage:\\pwsh.exe) TargetImage:\\lsass.exe