config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_module_path contains "\log.dll" and 
 (not 
 ((action_module_path in ("C:\Program Files\Bitdefender Antivirus Free\*", "C:\Program Files (x86)\Bitdefender Antivirus Free\*")) or 
 (actor_process_image_path = "C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe" and 
 (action_module_path in ("C:\Program Files\Dell\SARemediation\plugin\log.dll", "C:\Program Files\Dell\SARemediation\audit\log.dll"))) or 
 action_module_path contains "C:\Program Files\Canon\MyPrinter\" or 
 (action_module_path in ("C:\Program Files\AVAST Software\Avast\log.dll", "C:\Program Files (x86)\AVAST Software\Avast\log.dll")) or 
 (action_module_path in ("C:\Program Files\AVG\Antivirus\log.dll", "C:\Program Files (x86)\AVG\Antivirus\log.dll"))))) or 
 (action_module_path contains "\qrt.dll" and 
 (not 
 (action_module_path in ("C:\Program Files\F-Secure\Anti-Virus\*", "C:\Program Files (x86)\F-Secure\Anti-Virus\*")))) or 
 ((action_module_path in ("*\ashldres.dll", "*\lockdown.dll", "*\vsodscpl.dll")) and 
 (not 
 (action_module_path in ("C:\Program Files\McAfee\*", "C:\Program Files (x86)\McAfee\*")))) or 
 (action_module_path contains "\vftrace.dll" and 
 (not 
 (action_module_path in ("C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\*", "C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\*")))) or 
 (action_module_path contains "\wsc.dll" and 
 (not 
 ((action_module_path in ("C:\program Files\AVAST Software\Avast\*", "C:\program Files (x86)\AVAST Software\Avast\*")) or 
 (action_module_path in ("C:\Program Files\AVG\Antivirus\*", "C:\Program Files (x86)\AVG\Antivirus\*"))))) or 
 (action_module_path contains "\tmdbglog.dll" and 
 (not 
 (action_module_path in ("C:\program Files\Trend Micro\Titanium\*", "C:\program Files (x86)\Trend Micro\Titanium\*")))) or 
 (action_module_path contains "\DLPPREM32.dll" and 
 (not 
 (action_module_path in ("C:\program Files\ESET*", "C:\program Files (x86)\ESET*"))))))