(AccessList:%%4417* OR AccessList:%%4418*) (EventID:4656 OR EventID:4663) ObjectName:\\Microsoft\\Windows\ Defender\\Exclusions\\*