(EventID:5038 OR EventID:6281) (-((param1:\\CSFalconServiceUninstallTool_* OR param1:\\Program\ Files\\CrowdStrike\\* OR param1:\\System32\\drivers\\CrowdStrike\\* OR param1:\\Windows\\System32\\ScriptControl64_*) OR param1:\\Program\ Files\\Sophos\\*))