MigXmlHelper.IsOSEarlierThan("NT", "6.0") HKLM\System\CurrentControlSet\Services\SysmonLog\Log Queries\*[*]