(ParentImage:\\action1_agent.exe Image:\\Windows\\Action1\\package_downloads\\*) OR ((ParentImage:\\cmd.exe OR ParentImage:\\powershell.exe) (ParentCommandLine:\\Action1\\scripts\\Run_Command_* OR ParentCommandLine:\\Action1\\scripts\\Run_PowerShell_*)) OR Image:\\agent1_remote.exe