from * metadata _id, _index, _version | where (ends_with(process.executable.caseless, "\\powershell.exe") or ends_with(process.executable.caseless, "\\pwsh.exe")) and (process.command_line like "* -e *" or process.command_line like "* -en *" or process.command_line like "* -enc *" or process.command_line like "* -enco*" or process.command_line like "* -ec *")
