(EventID:4697 ServiceFileName:^%systemroot%\\\\[a-zA-Z]{8}\\.exe$ ServiceName:(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$) ServiceStartType:3 ServiceType:0x10) (-ServiceName:PSEXESVC)