(CommandLine:\/EXEFilename* OR CommandLine:\/CommandLine*) ((CommandLine:\ \/RunAs\ 8\ * OR CommandLine:\ \/RunAs\ 4\ * OR CommandLine:\ \/RunAs\ 10\ * OR CommandLine:\ \/RunAs\ 11\ *) OR (CommandLine:\/RunAs\ 8 OR CommandLine:\/RunAs\ 4 OR CommandLine:\/RunAs\ 10 OR CommandLine:\/RunAs\ 11))