(Image:\\netsh.exe OR OriginalFileName:netsh.exe) ((CommandLine:firewall\ * CommandLine:add\ * CommandLine:tcp\ * CommandLine:3389*) (CommandLine:portopening* OR CommandLine:allow*))