TargetImage="*\\lsass.exe" GrantedAccess IN ("0x1010", "0x1410", "0x1438", "0x143a", "0x1fffff") NOT ((SourceImage="C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*" SourceImage="*\\MsMpEng.exe") OR SourceImage="C:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe")
