(Image:\\plink.exe CommandLine:\:127.0.0.1\:3389*) OR ((Image:\\plink.exe CommandLine:\:3389*) (CommandLine:\ \-P\ 443* OR CommandLine:\ \-P\ 22*))