CommandLine:ping\\s+-n.{6,64}echo EEEE\\s?>\\s? OR (CommandLine:ipconfig\\s+/all CommandLine:\\temp\\res.ip*) OR (CommandLine:interface\ ip\ show\ config* CommandLine:\\temp\\netsh.res*)