((ParentImage:\\wscript.exe OR ParentImage:\\cscript.exe) (Image:\\powershell.exe OR Image:\\pwsh.exe)) (-CurrentDirectory:\\Health\ Service\ State\\*)