(Image:\/rm OR Image:\/unlink OR Image:\/shred) (CommandLine:\/var\/log* OR (CommandLine:\/Users\/* CommandLine:\/Library\/Logs\/*))