#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\tasklist\.exe/) OR (/(Get-Process|CreateToolhelp32Snapshot)/i))