from * metadata _id, _index, _version | where ends_with(winlog.event_data.TargetImage, "\\lsass.exe") and (winlog.event_data.GrantedAccess in ("0x1010", "0x1410", "0x1438", "0x143a", "0x1fffff")) and not (starts_with(process.executable.caseless, "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\") and ends_with(process.executable.caseless, "\\MsMpEng.exe") or process.executable.caseless=="C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe")
