((TargetObject:\\System\\* TargetObject:ControlSet* TargetObject:\\Services\\*) TargetObject:\\Parameters\\ServiceDll) (-(Details:C\:\\Windows\\system32\\spool\\drivers\\x64\\3\\PrintConfig.dll OR (Image:C\:\\Windows\\system32\\lsass.exe TargetObject:\\Services\\NTDS\\Parameters\\ServiceDll Details:%%systemroot%%\\system32\\ntdsa.dll) OR Image:C\:\\Windows\\System32\\poqexec.exe)) (-(Image:\\regsvr32.exe Details:C\:\\Windows\\System32\\STAgent.dll))