((http.request.uri.path contains "/xmlrpc.php") or (http.request.uri.path 
contains "/wp-login.php") or (http.request.uri.path contains "/wp-admin/" 
and not http.request.uri.path contains "/wp-admin/admin-ajax.php" and not 
http.request.uri.path contains "/wp-admin/theme-editor.php")) and 
ip.geoip.country ne "MY"