((Image:\\Werfault.exe OR OriginalFileName:WerFault.exe) ((ParentUser:AUTHORI* OR ParentUser:AUTORI*) (User:AUTHORI* OR User:AUTORI*) (CommandLine:\ \-u\ \-p\ * CommandLine:\ \-ip\ * CommandLine:\ \-s\ *))) (-ParentImage:C\:\\Windows\\System32\\lsass.exe)