(Image:\\KrbRelayUp.exe OR OriginalFileName:KrbRelayUp.exe) OR (CommandLine:\ relay\ * CommandLine:\ \-Domain\ * CommandLine:\ \-ComputerName\ *) OR (CommandLine:\ krbscm\ * CommandLine:\ \-sc\ *) OR (CommandLine:\ spawn\ * CommandLine:\ \-d\ * CommandLine:\ \-cn\ * CommandLine:\ \-cp\ *)