(TargetObject:\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\* TargetObject:\\ChannelAccess (Details:\(A;;0x1;;;LA\)* OR Details:\(A;;0x1;;;SY\)* OR Details:\(A;;0x5;;;BA\)*)) (-(Image:C\:\\Windows\\servicing\\TrustedInstaller.exe OR (Image:C\:\\Windows\\WinSxS\\* Image:\\TiWorker.exe)))