When is it an AND and when is it an OR ?

[swiftonsecurity]

When is it an AND and when is it an OR ?

[gwsales]

All the testing I've done has shown that the "AND" isn't working as documented and everything is just a big "OR".

According to the docs:

Within a rule, filter conditions on the same field have OR behavior, whereas conditions on different fields have AND behavior.

[KaptainKool]

@gwsales Thank you ! I was wondering if I was the only person who was seeing that (I certainly know I'm not, but then why does the developer say that the AND condition works in the official Sysmon download page.)

Tons of infosec people are using Sysmon, and this config is called out everywhere as a reference guide. Requesting the author (or any of the experienced community leaders) to please help clarify this one seemingly simple & basic question.

Here is another place I've asked the same question & got no response back:
https://gist.github.com/Neo23x0/f56bea38d95040b70cf5#comments