((ParentImage:\\tomcat8.exe OR ParentImage:\\tomcat9.exe OR ParentImage:\\tomcat10.exe) ParentCommandLine:confluence*) ((Image:\\cmd.exe OR Image:\\powershell.exe) OR (OriginalFileName:Cmd.Exe OR OriginalFileName:PowerShell.EXE))