(EventID:4648 (ProcessName:\\cmd.exe OR ProcessName:\\powershell.exe OR ProcessName:\\pwsh.exe OR ProcessName:\\winrs.exe OR ProcessName:\\wmic.exe OR ProcessName:\\net.exe OR ProcessName:\\net1.exe OR ProcessName:\\reg.exe)) (-(TargetServerName:localhost OR (SubjectUserName:$ TargetUserName:$)))