Sticky key sethc command for replacement by CMD

Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.