(ParentImage:\\consent.exe Image:\\iexplore.exe CommandLine:\ http*) ((IntegrityLevel:System OR IntegrityLevel:S\-1\-16\-16384) OR (User:AUTHORI* OR User:AUTORI*))