(#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\net1?\.exe/i CommandLine=/(user|group).+\/domain/i) OR (#event_simpleName=/^(CommandHistory|ScriptControl)/ event_platform=Win /Get-ADUser|Get-ADGroupMember/i)