((Image:\\net.exe OR Image:\\net1.exe) OR (OriginalFileName:net.exe OR OriginalFileName:net1.exe)) ((((CommandLine:\ group\ * OR CommandLine:\ localgroup\ *) (CommandLine:domain\ admins* OR CommandLine:\ administrator* OR CommandLine:\ administrateur* OR CommandLine:enterprise\ admins* OR CommandLine:Exchange\ Trusted\ Subsystem* OR CommandLine:Remote\ Desktop\ Users* OR CommandLine:Utilisateurs\ du\ Bureau\ à\ distance* OR CommandLine:Usuarios\ de\ escritorio\ remoto* OR CommandLine:\ \/do*)) (-CommandLine:\ \/add*)) OR (CommandLine:\ accounts\ * CommandLine:\ \/do*))