(TargetImage:\\lsass.exe ((GrantedAccess:30 OR GrantedAccess:50 OR GrantedAccess:70 OR GrantedAccess:90 OR GrantedAccess:B0 OR GrantedAccess:D0 OR GrantedAccess:F0 OR GrantedAccess:18 OR GrantedAccess:38 OR GrantedAccess:58 OR GrantedAccess:78 OR GrantedAccess:98 OR GrantedAccess:B8 OR GrantedAccess:D8 OR GrantedAccess:F8 OR GrantedAccess:1A OR GrantedAccess:3A OR GrantedAccess:5A OR GrantedAccess:7A OR GrantedAccess:9A OR GrantedAccess:BA OR GrantedAccess:DA OR GrantedAccess:FA OR GrantedAccess:0x14C2) OR (GrantedAccess:0x100000* OR GrantedAccess:0x1418* OR GrantedAccess:0x1438* OR GrantedAccess:0x143a* OR GrantedAccess:0x1f0fff* OR GrantedAccess:0x1f1fff* OR GrantedAccess:0x1f2fff* OR GrantedAccess:0x1f3fff* OR GrantedAccess:0x40*))) (-((SourceImage:\:\\Program\ Files\ \(x86\)\\* OR SourceImage:\:\\Program\ Files\\* OR SourceImage:\:\\Windows\\System32\\* OR SourceImage:\:\\Windows\\SysWOW64\\*) OR (SourceImage:\:\\ProgramData\\Microsoft\\Windows\ Defender\\* SourceImage:\\MsMpEng.exe) OR ((CallTrace:|*\:\\ProgramData\\Microsoft\\Windows\ Defender\\Definition\ Updates\\\{* CallTrace:\}\\mpengine.dll\+*) GrantedAccess:0x1418) OR (CallTrace:|c\:\\program\ files\\windows\ defender\\mprtp.dll* OR CallTrace:|c\:\\program\ files\\windows\ defender\\MpClient.dll*) OR (SourceImage:\\explorer.exe GrantedAccess:0x401))) (-(SourceImage:\:\\ProgramData\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe OR SourceImage:\\AppData\\Local\\Programs\\Microsoft\ VS\ Code\\Code.exe OR (SourceImage:\:\\ProgramData\\VMware\\VMware\ Tools\\* SourceImage:\\vmtoolsd.exe) OR ((SourceImage:\\PROCEXP64.EXE OR SourceImage:\\PROCEXP.EXE) GrantedAccess:0x40) OR (SourceImage:\\MBAMInstallerService.exe GrantedAccess:0x40) OR ((SourceImage:\\aurora\-agent\-64.exe OR SourceImage:\\aurora\-agent.exe OR SourceImage:\\thor.exe OR SourceImage:\\thor64.exe) GrantedAccess:0x40) OR ((SourceImage:\\handle.exe OR SourceImage:\\handle64.exe) GrantedAccess:0x40) OR (SourceImage:\\AppData\\Local\\WebEx\\WebexHost.exe GrantedAccess:0x401) OR SourceImage:\\SteamLibrary\\steamapps\\*))