#event_simpleName=/^(ProcessRollup2|CommandHistory|ScriptControl)/ event_platform=Win ((ImageFileName=/\\net1?\.exe/i CommandLine=/accounts/i) OR (/(Get-ADDefaultDomainPasswordPolicy|GetAccountPasswordPolicy)/i))