(Image:\\schtasks.exe OR OriginalFileName:schtasks.exe) ((CommandLine:\ \/create\ * CommandLine:sshd.exe* CommandLine:\-f*) OR (CommandLine:\ \/create\ * CommandLine:ssh.exe* CommandLine:\-i*))