((CommandLine:localgroup\ * CommandLine:\ \/add*) OR (CommandLine:Add\-LocalGroupMember\ * CommandLine:\ \-Group\ *)) (CommandLine:Remote\ Desktop\ Users* OR CommandLine:Utilisateurs\ du\ Bureau\ à\ distance* OR CommandLine:Usuarios\ de\ escritorio\ remoto*)