CommandLine:base64\ * ((CommandLine:|\ bash\ * OR CommandLine:|\ sh\ * OR CommandLine:|bash\ * OR CommandLine:|sh\ *) OR (CommandLine:\ |sh OR CommandLine:|\ bash OR CommandLine:|\ sh OR CommandLine:|bash))