(Image:\\SharpImpersonation.exe OR OriginalFileName:SharpImpersonation.exe) OR ((CommandLine:\ user\:* CommandLine:\ binary\:*) OR (CommandLine:\ user\:* CommandLine:\ shellcode\:*) OR (CommandLine:\ technique\:CreateProcessAsUserW* OR CommandLine:\ technique\:ImpersonateLoggedOnuser*))