(Provider_Name:Service\ Control\ Manager EventID:7045) (ImagePath:^[a-zA-Z]:\\\\windows\\\\temp\\\\[a-zA-Z0-9]{10}\\.exe OR (ServiceName:Sliver OR ServiceName:Sliver\ implant))