config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name in ("*:\ProgramData\4800-84DC-063A6A41C5C", "*:\ProgramData\clip.exe", "*:\ProgramData\DSROLE.dll", "*:\ProgramData\Forest64.exe", "*:\ProgramData\readme.md", "*:\ProgramData\Version.dll", "*:\ProgramData\wsmprovhost.exe")))