config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name contains ".lnk" and 
 (action_file_name in ("*.doc.*", "*.docx.*", "*.jpg.*", "*.pdf.*", "*.ppt.*", "*.pptx.*", "*.xls.*", "*.xlsx.*"))) and 
 (not 
 action_file_name contains "\AppData\Roaming\Microsoft\Windows\Recent\") and 
 (not 
 (((actor_process_image_path in ("*\excel.exe", "*\powerpnt.exe", "*\winword.exe")) and 
 action_file_name contains "\AppData\Roaming\Microsoft\Office\Recent\") or 
 (actor_process_image_path contains "\excel.exe" and 
 action_file_name contains "\AppData\Roaming\Microsoft\Excel") or 
 (actor_process_image_path contains "\powerpnt.exe" and 
 action_file_name contains "\AppData\Roaming\Microsoft\PowerPoint") or 
 (actor_process_image_path contains "\winword.exe" and 
 action_file_name contains "\AppData\Roaming\Microsoft\Word")))))