(OriginalFileName:iCACLS.EXE OR Image:\\icacls.exe) (CommandLine:\/deny* CommandLine:S\-1\-1\-0\:*)