config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path in ("*\cmd.exe", "*\powershell_ise.exe", "*\powershell.exe", "*\pwsh.exe", "*\w3wp.exe")) and 
 (action_file_name in ("C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\*", "C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\*")) and 
 (action_file_name in ("*\15\TEMPLATE\LAYOUTS\*", "*\16\TEMPLATE\LAYOUTS\*")) and 
 (action_file_name in ("*.asax", "*.ascx", "*.ashx", "*.asmx", "*.asp", "*.aspx", "*.bat", "*.cmd", "*.cer", "*.config", "*.hta", "*.js", "*.jsp", "*.jspx", "*.php", "*.ps1", "*.vbs"))))