(Image:\/dscacheutil (CommandLine:\-q* CommandLine:group*)) OR (Image:\/cat CommandLine:\/etc\/group*) OR (Image:\/dscl (CommandLine:\-list* CommandLine:\/groups*))