Image IN ("*\\powershell.exe", "*\\pwsh.exe") CommandLine IN ("* -e *", "* -en *", "* -enc *", "* -enco*", "* -ec *")
