(Image:\\rundll32.exe OR OriginalFileName:RUNDLL32.EXE) ParentImage:\\cmd.exe CommandLine:user32.dll,* CommandLine:LockWorkStation*