(Image:\/usr\/bin\/file CommandLine:(.){200,}) OR (Image:\/bin\/ls CommandLine:\-R*) OR Image:\/usr\/bin\/find OR Image:\/usr\/bin\/mdfind OR Image:\/tree