process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe", "cmd.exe") or ?process.pe.original_file_name : ("powershell ...