<ImageLoad onmatch="include">
    <Rule groupRelation="and">
    </Rule>
        <Rule groupRelation="and" name="RDP Abuse - T1076">
            <Image condition="excludes">mstsc.exe</Image>
            <ImageLoaded condition="contains">mstscax.dll</ImageLoaded>
    </Rule>
</ImageLoad>