Another sysmon and PowerShell tip