((Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) ((CommandLine:\-s* OR CommandLine:\/s* OR CommandLine:–s* OR CommandLine:—s* OR CommandLine:―s*) CommandLine:dir\ *)) (-CommandLine:rmdir*)