(Provider_Name:Service\ Control\ Manager EventID:7045) (((ImagePath:\/c* ImagePath:echo* ImagePath:\\pipe\\*) (ImagePath:cmd* OR ImagePath:%COMSPEC%*)) OR (ImagePath:rundll32* ImagePath:.dll,a* ImagePath:\/p\:*) OR ImagePath:\\\\127.0.0.1\\ADMIN$\\*)