Data:HostApplication=* (-(Data:HostApplication=*\:\/Windows\/System32\/WindowsPowerShell\/v1.0\/powershell* OR Data:HostApplication=*\:\/Windows\/SysWOW64\/WindowsPowerShell\/v1.0\/powershell* OR Data:HostApplication=*\:\\Windows\\System32\\sdiagnhost.exe* OR Data:HostApplication=*\:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell* OR Data:HostApplication=*\:\\Windows\\SysWOW64\\sdiagnhost.exe* OR Data:HostApplication=*\:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell* OR Data:HostApplication=powershell*)) (-(Data:Citrix\\ConfigSync\\ConfigSync.ps1* OR Data:HostApplication=C\:\\Hexnode\\Hexnode\ Agent\\Current\\HexnodeAgent.exe*))