File or Folder Permissions Modifications

Action1: actionname = "Process started" AND ((PROCESSNAME endswith "\cacls.exe,\icacls.exe,\net.exe,\net1.exe" AND COMMANDLINE contains "/grant,/setowner,/inheritance:r") OR (PROCESSNAME endswith "\attrib.exe" AND COMMANDLINE contains "-r") OR PROCESSNAME endswith "\takeown.exe") AND (COMMANDLINE notendswith "ICACLS C:\ProgramData\dynatrace\gateway\config\connectivity.history /reset" AND (COMMANDLINE notcontains "ICACLS C:\ProgramData\dynatrace\gateway\config\config.properties /grant :r " OR COMMANDLINE notcontains "S-1-5-19:F") AND COMMANDLINE notcontains "\AppData\Local\Programs\Microsoft VS Code,:\Program Files\Microsoft VS Code" AND COMMANDLINE notcontains ":\Program Files (x86)\Avira,:\Program Files\Avira") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME