(TargetObject:SYSTEM\\* TargetObject:ControlSet* TargetObject:\\Control\\Lsa*) ((TargetObject:\\lmcompatibilitylevel (Details:DWORD\ \(0x00000000\) OR Details:DWORD\ \(0x00000001\) OR Details:DWORD\ \(0x00000002\))) OR (TargetObject:\\NtlmMinClientSec (Details:DWORD\ \(0x00000000\) OR Details:DWORD\ \(0x00000010\) OR Details:DWORD\ \(0x00000020\) OR Details:DWORD\ \(0x00000030\))) OR TargetObject:\\RestrictSendingNTLMTraffic)