(endpoint:spoolss operation:RpcAddMonitor) OR (endpoint:spoolss operation:RpcAddPrintProcessor) OR (endpoint:IRemoteWinspool operation:RpcAsyncAddMonitor) OR (endpoint:IRemoteWinspool operation:RpcAsyncAddPrintProcessor) OR (endpoint:ISecLogon operation:SeclCreateProcessWithLogonW) OR (endpoint:ISecLogon operation:SeclCreateProcessWithLogonExW)