config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_module_path in ("*\fastprox.dll", "*\wbemcomn.dll", "*\wbemprox.dll", "*\wbemsvc.dll", "*\WmiApRpl.dll", "*\wmiclnt.dll", "*\WMINet_Utils.dll", "*\wmiprov.dll", "*\wmiutils.dll")) and 
 (not 
 (actor_process_image_path in ("*:\Program Files (x86)\*", "*:\Program Files\*", "*:\Windows\explorer.exe*", "*:\Windows\Microsoft.NET\Framework\*", "*:\Windows\Microsoft.NET\FrameworkArm\*", "*:\Windows\Microsoft.NET\FrameworkArm64\*", "*:\Windows\Microsoft.NET\Framework64\*", "*:\Windows\System32\*", "*:\Windows\SysWOW64\*"))) and 
 (not 
 ((actor_process_image_path in ("*\WindowsAzureGuestAgent.exe", "*\WaAppAgent.exe")) or 
 (actor_process_image_path in ("*\thor.exe", "*\thor64.exe")) or 
 actor_process_image_path contains "\MsMpEng.exe" or 
 (actor_process_image_path in ("*\Microsoft\Teams\current\Teams.exe*", "*\Microsoft\Teams\Update.exe*")) or 
 (actor_process_image_path in ("*:\Windows\Sysmon.exe", "*:\Windows\Sysmon64.exe"))))))