((Payload:get\-localgroup\ * OR Payload:get\-localgroupmember\ *) OR (ContextInfo:get\-localgroup\ * OR ContextInfo:get\-localgroupmember\ *)) OR (((Payload:get\-wmiobject\ * OR Payload:gwmi\ * OR Payload:get\-ciminstance\ * OR Payload:gcim\ *) OR (ContextInfo:get\-wmiobject\ * ContextInfo:gwmi\ * ContextInfo:get\-ciminstance\ * ContextInfo:gcim\ *)) (Payload:win32_group* OR ContextInfo:win32_group*))