event.category:process and host.os.type:windows and
  (powershell.file.script_block_text : (
    "Windows.Clipboard" or
    "Windows.Forms.Clipboard" or
    "Windows.Forms.TextBox"
   ) and
   powershell.file.script_block_text : (
    "]::GetText" or
    ".Paste()"
  )) or powershell.file.script_block_text : "Get-Clipboard" and
  not powershell.file.script_block_text : (
    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
  ) and
  not user.id : "S-1-5-18" and
  not (
    file.path : C\:\\Program?Files\\WindowsPowerShell\\*Modules*.ps1 and
    file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
  )