(Image:\\KrbRelay.exe OR OriginalFileName:KrbRelay.exe) OR (CommandLine:\ \-spn\ * CommandLine:\ \-clsid\ * CommandLine:\ \-rbcd\ *) OR (CommandLine:shadowcred* CommandLine:clsid* CommandLine:spn*) OR (CommandLine:spn\ * CommandLine:session\ * CommandLine:clsid\ *)