(Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE) ((CommandLine:C\:\\windows\\system32\\davclnt.dll,DavSetCookie* CommandLine:http*) (CommandLine:spoolss* OR CommandLine:srvsvc* OR CommandLine:\/print\/pipe\/*))