(Image:\/dscl (CommandLine:list* CommandLine:\/users*)) OR (Image:\/dscacheutil (CommandLine:\-q* CommandLine:user*)) OR CommandLine:'x\:0\:'* OR (Image:\/cat (CommandLine:\/etc\/passwd* OR CommandLine:\/etc\/sudoers*)) OR Image:\/id OR (Image:\/lsof CommandLine:\-u*)