source="WinEventLog:System" EventCode=7045 ImagePath IN ("*\\AppData\\*", "*\\Temp\\*", "*\\Users\\Public\\*")
