(((Image:\\find.exe OR Image:\\findstr.exe) OR (OriginalFileName:FIND.EXE OR OriginalFileName:FINDSTR.EXE)) (CommandLine:\"Everyone\"* OR CommandLine:'Everyone'* OR CommandLine:\"BUILTIN\\\"* OR CommandLine:'BUILTIN\\'*)) OR (CommandLine:icacls\ * CommandLine:findstr\ * CommandLine:Everyone*)