config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name in ("*\Inveigh-Log.txt", "*\Inveigh-Cleartext.txt", "*\Inveigh-NTLMv1Users.txt", "*\Inveigh-NTLMv2Users.txt", "*\Inveigh-NTLMv1.txt", "*\Inveigh-NTLMv2.txt", "*\Inveigh-FormInput.txt", "*\Inveigh.dll", "*\Inveigh.exe", "*\Inveigh.ps1", "*\Inveigh-Relay.ps1")))