((Image:PetitPotam* OR Image:RottenPotato* OR Image:HotPotato* OR Image:JuicyPotato* OR Image:\\just_dce_* OR Image:Juicy\ Potato* OR Image:\\temp\\rot.exe* OR Image:\\Potato.exe* OR Image:\\SpoolSample.exe* OR Image:\\Responder.exe* OR Image:\\smbrelayx* OR Image:\\ntlmrelayx* OR Image:\\LocalPotato*) OR (CommandLine:Invoke\-Tater* OR CommandLine:\ smbrelay* OR CommandLine:\ ntlmrelay* OR CommandLine:cme\ smb\ * OR CommandLine:\ \/ntlm\:NTLMhash\ * OR CommandLine:Invoke\-PetitPotam* OR CommandLine:.exe\ \-t\ *\ \-p\ *) OR (CommandLine:.exe\ \-c\ \"\{* CommandLine:\}\"\ \-z)) (-(Image:HotPotatoes6* OR Image:HotPotatoes7* OR Image:HotPotatoes\ *))