CommandLine:Get\-Process\ lsas* OR CommandLine:ps\ lsas* OR CommandLine:gps\ lsas*