lt;image

According to the Sysmon documentation, within a rule, filter conditions have an OR behavior by default. If I wanted to…

event, lt;image, process