Image:\/cp CommandLine:\/tmp\/* (CommandLine:passwd* OR CommandLine:shadow*)