(OriginalFileName:netsh.exe OR Image:\\netsh.exe) (CommandLine:add* CommandLine:helper*)