config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path in ("*\excel.exe", "*\mspub.exe", "*\outlook.exe", "*\onenote.exe", "*\onenoteim.exe", "*\powerpnt.exe", "*\winword.exe")) and 
 (action_module_path in ("*\System.Management.Automation.Dll*", "*\System.Management.Automation.ni.Dll*"))))