Does not equal filtering question

Question

I want to see all the executables run in the user's home directory. I can see that information with the ProcessStart.ExtraneousInfo *C:\Users* but when I try to filter out all of the usual executables that run in that folder it does not seem to filter them.

Example of the rule I created:

Any suggestions on how to get this working?

blsanner · Accepted Answer

While it seems like your logic should work, I was able to reproduce this in my environment. To get it to work, move all of the not equals statements into a separate group as such:

Logically, you would think it would be the same thing, but I had to do this to get it to work.

Does not equal filtering question

Top Replies