config case_sensitive = false | preset=xdr_registry | filter event_type = ENUM.REGISTRY and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model" or 
 (action_registry_key_name in ("*Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\*", "*Classes\AppX3bbba44c6cae4d9695755183472171e2\*", "*Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\*", "*Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model*")) or 
 (action_registry_key_name contains "\SOFTWARE\App\" and 
 ((action_registry_key_name in ("*AppXbf13d4ea2945444d8b13e2121cb6b663\*", "*AppX70162486c7554f7f80f481985d67586d\*", "*AppX37cc7fdccd644b4f85f4b22d5a3f105a\*")) and 
 (action_registry_key_name in ("*Application", "*DefaultIcon"))))))