(TargetObject:\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt* OR TargetObject:\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt*) (-(Image:C\:\\Windows\\system32\\lsass.exe (Details:%%systemroot%%\\system32\\ntdsa.dll OR Details:%%systemroot%%\\system32\\lsadb.dll)))