Can I use != in blacklist?

I only want to see cmd.exe and blacklist everything else for EventCode 4688. blacklist = EventCode="4688" Message="(?:New Process Name:).+(?:cmd.exe)" will remove cmd.exe but 'Message!=' doesn't do the opposite.