winlog.channel:System AND (event.code:7045 AND (winlog.event_data.ImagePath:(*\\AppData\\* OR *\\Temp\\* OR *\\Users\\Public\\*)))
