#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/localgroup/i) OR (/get-localgroup/i))