config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((((action_file_name contains "\Microsoft\Word\STARTUP" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\STARTUP")) and 
 (not 
 (action_file_name in ("*.docb", "*.docm", "*.docx", "*.dotm", "*.mdb", "*.mdw", "*.pdf", "*.wll", "*.wwl")))) or 
 ((action_file_name contains "\Microsoft\Excel\XLSTART" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\XLSTART")) and 
 (not 
 (action_file_name in ("*.xll", "*.xls", "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xlw"))))) and 
 (not 
 ((actor_process_image_path contains ":\Program Files\Common Files\Microsoft Shared\ClickToRun\" and 
 actor_process_image_path contains "\OfficeClickToRun.exe") or 
 ((actor_process_image_path in ("*:\Program Files\Microsoft Office\*", "*:\Program Files (x86)\Microsoft Office\*")) and 
 (actor_process_image_path in ("*\winword.exe", "*\excel.exe")))))))