(winlog.event_data.TargetImage:*\\lsass.exe AND (winlog.event_data.GrantedAccess:(0x1010 OR 0x1410 OR 0x1438 OR 0x143a OR 0x1fffff))) AND (NOT ((process.executable.caseless:C\:\\ProgramData\\Microsoft\\Windows\ Defender\\Platform\\* AND process.executable.caseless:*\\MsMpEng.exe) OR process.executable.caseless:"C\:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe"))
