Unusual Web Config File Access

event.category:file and host.os.type:windows and event.action:open and
  file.name:"web.config" and file.path : *VirtualDirectories* and
  not process.executable: (
        "C:\Program Files\Microsoft Security Client\MsMpEng.exe" or
        "C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe" or
        "C:\Windows\System32\MRT.exe"
  )