#event_simpleName=ProcessRollup2 event_platform=Win ((ImageFileName=/\\(fsutil|fsinfo|drives|systeminfo|vssadmin|hostname)\.exe/i) OR (ImageFileName=/\\net1?\.exe/i CommandLine=/config/i))