Image:\/lastlog OR CommandLine:'x\:0\:'* OR ((Image:\/cat OR Image:\/ed OR Image:\/head OR Image:\/more OR Image:\/nano OR Image:\/tail OR Image:\/vi OR Image:\/vim OR Image:\/less OR Image:\/emacs OR Image:\/sqlite3 OR Image:\/makemap) (CommandLine:\/etc\/passwd* OR CommandLine:\/etc\/shadow* OR CommandLine:\/etc\/sudoers* OR CommandLine:\/etc\/spwd.db* OR CommandLine:\/etc\/pwd.db* OR CommandLine:\/etc\/master.passwd*)) OR Image:\/id OR (Image:\/lsof CommandLine:\-u*)