✄𐘗
text code block:
✄𐘗sequence by host.id with maxspan=5s
   [process where host.os.type == "windows" and event.type == "end" and
    process.code_signature.trusted != true and
    not process.executable like
             ("C:\\Windows\\SoftwareDistribution\\*.exe",
              "C:\\Windows\\WinSxS\\*.exe",
              "?:\\Windows\\Postillion\\Office\\*.exe") and
    not (
      process.name : "infinst.exe" and process.parent.name: "dxsetup.exe" and
      process.parent.code_signature.subject_name == "NVIDIA Corporation" and
      process.parent.code_signature.status == "trusted"
    )
   ] by process.executable
   [file where host.os.type == "windows" and event.type == "deletion" and file.extension in~ ("exe", "scr", "com") and
    not process.executable like
             ("?:\\Program Files\\*.exe",
              "?:\\Program Files (x86)\\*.exe",
              "?:\\Windows\\System32\\svchost.exe",
              "?:\\Windows\\System32\\drvinst.exe",
              "?:\\Windows\\Postillion\\Office\\*.exe") and
    not file.path like (
          "?:\\Program Files\\*.exe",
          "?:\\Program Files (x86)\\*.exe",
          "?:\\Windows\\Temp\\*\\DismHost.exe",
          "?:\\$WINDOWS.~BT\\Work\\*\\DismHost.exe",
          "?:\\$WinREAgent\\Scratch\\*\\DismHost.exe",
          "?:\\Windows\\tenable_mw_scan_*.exe",
          "?:\\Users\\*\\AppData\\Local\\Temp\\LogiUI\\Pak\\uninstall.exe",
          "?:\\ProgramData\\chocolatey\\*.exe"
    ) and
    not (process.name : "OktaVerifySetup-*.exe" and process.code_signature.subject_name == "Okta, Inc.") and
    not (
      process.executable : "?:\\Windows\\SysWOW64\\config\\systemprofile\\Citrix\\UpdaterBinaries\\CitrixReceiver\\*" and
      process.code_signature.subject_name == "Citrix Systems, Inc." and
      file.path : "?:\\Windows\\SysWOW64\\config\\systemprofile\\Citrix\\UpdaterBinaries\\CitrixReceiver\\*\\bootstrapperhelper.exe"
    )
   ] by file.path