CommandLine:\/logon\:none* OR CommandLine:\/system\:none* OR CommandLine:\/sam\:none* OR CommandLine:\/privilege\:none* OR CommandLine:\/object\:none* OR CommandLine:\/process\:none* OR CommandLine:\/policy\:none*