config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((((action_file_name contains "\Microsoft\Word\STARTUP" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\STARTUP")) and 
 (action_file_name in ("*.doc", "*.docm", "*.docx", "*.dot", "*.dotm", "*.rtf"))) or 
 ((action_file_name contains "\Microsoft\Excel\XLSTART" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\XLSTART")) and 
 (action_file_name in ("*.xls", "*.xlsm", "*.xlsx", "*.xlt", "*.xltm")))) and 
 (not 
 (actor_process_image_path in ("*\WINWORD.exe", "*\EXCEL.exe")))))