((Image:\\powershell_ise.exe OR Image:\\powershell.exe OR Image:\\pwsh.exe) OR (OriginalFileName:PowerShell_ISE.EXE OR OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll)) ((CommandLine:new\-object* CommandLine:net.webclient\).* CommandLine:download*) (CommandLine:string\(* OR CommandLine:file\(*))