((EventID:4663 OR EventID:4656) (AccessMask:0x100000 OR AccessMask:0x1010 OR AccessMask:0x1400 OR AccessMask:0x1410 OR AccessMask:0x1418 OR AccessMask:0x1438 OR AccessMask:0x143a OR AccessMask:0x1f0fff OR AccessMask:0x1f1fff OR AccessMask:0x1f2fff OR AccessMask:0x1f3fff OR AccessMask:0x40 OR AccessMask:143a OR AccessMask:1f0fff OR AccessMask:1f1fff OR AccessMask:1f2fff OR AccessMask:1f3fff) ObjectType:Process ObjectName:\\lsass.exe) (-(SubjectUserName:$ OR (ProcessName:\:\\Program\ Files\\* OR ProcessName:\:\\Program\ Files\ \(x86\)\\*) OR (ProcessName:C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe AccessMask:0x1410))) (-ProcessName:\\SteamLibrary\\steamapps\\*)