config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name in ("*\u202e*", "*[U+202E]*", "*‮*")) and 
 (action_file_name in ("*3pm.*", "*4pm.*", "*cod.*", "*fdp.*", "*ftr.*", "*gepj.*", "*gnp.*", "*gpj.*", "*ism.*", "*lmth.*", "*nls.*", "*piz.*", "*slx.*", "*tdo.*", "*vsc.*", "*vwm.*", "*xcod.*", "*xslx.*", "*xtpp.*"))))