((Image:\\reg.exe OR OriginalFileName:reg.exe) (CommandLine:\ add\ * CommandLine:\\CurrentControlSet\\Control\\Terminal\ Server* CommandLine:REG_DWORD* CommandLine:\ \/f*)) ((CommandLine:Licensing\ Core* CommandLine:EnableConcurrentSessions*) OR (CommandLine:AllowTSConnections* OR CommandLine:fDenyTSConnections* OR CommandLine:fEnableWinStation* OR CommandLine:fSingleSessionPerUser* OR CommandLine:IdleWinStationPoolCount* OR CommandLine:MaxInstanceCount* OR CommandLine:SecurityLayer* OR CommandLine:TSAdvertise* OR CommandLine:TSAppCompat* OR CommandLine:TSEnabled* OR CommandLine:TSUserEnabled* OR CommandLine:WinStations\\RDP\-Tcp*)) (-(CommandLine:SecurityLayer* CommandLine:02*))