(Image:\\mstsc.exe OR OriginalFileName:mstsc.exe) (CommandLine:.rdp OR CommandLine:.rdp\") (CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\System32\\spool\\drivers\\color* OR CommandLine:\:\\Windows\\System32\\Tasks_Migrated\ * OR CommandLine:\:\\Windows\\Tasks\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\:\\Windows\\Tracing\\* OR CommandLine:\\AppData\\Local\\Temp\\* OR CommandLine:\\Downloads\\*)