config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\DllHost.exe" and 
 (actor_process_command_line in ("* /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}*", "* /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}*", "* /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}*", "* /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}*", "* /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}*")) and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))