config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains ".rdp" and 
 (actor_process_image_path in ("*\brave.exe", "*\CCleaner Browser\Application\CCleanerBrowser.exe", "*\chromium.exe", "*\firefox.exe", "*\Google\Chrome\Application\chrome.exe", "*\iexplore.exe", "*\microsoftedge.exe", "*\msedge.exe", "*\Opera.exe", "*\Vivaldi.exe", "*\Whale.exe", "*\olk.exe", "*\Outlook.exe", "*\RuntimeBroker.exe", "*\Thunderbird.exe", "*\Discord.exe", "*\Keybase.exe", "*\msteams.exe", "*\Slack.exe", "*\teams.exe"))))