((EventID:4625 OR EventID:4624) LogonType:3 AuthenticationPackageName:NTLM WorkstationName:^[A-Za-z0-9]{16}$) OR (EventID:4776 Workstation:^[A-Za-z0-9]{16}$)