((Image:\\RpcPing.exe OR OriginalFileName:\\RpcPing.exe) (CommandLine:\-s* OR CommandLine:\/s* OR CommandLine:–s* OR CommandLine:—s* OR CommandLine:―s*)) (((CommandLine:\-u* OR CommandLine:\/u* OR CommandLine:–u* OR CommandLine:—u* OR CommandLine:―u*) CommandLine:NTLM*) OR ((CommandLine:\-t* OR CommandLine:\/t* OR CommandLine:–t* OR CommandLine:—t* OR CommandLine:―t*) CommandLine:ncacn_np*))