CommandLine:type\ %windir%\\system32\\ntdll.dll* OR CommandLine:type\ %systemroot%\\system32\\ntdll.dll* OR CommandLine:type\ c\:\\windows\\system32\\ntdll.dll* OR CommandLine:\\ntdll.dll\ >\ \\\\.\\pipe\\*