✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and
  event.provider == "Microsoft-Windows-Sysmon" and event.code == "2" and
  file.extension : (
    "exe", "dll", "sys", "msi", "scr", "pif", "lnk"
  ) and
  file.path : (
    "?:\\Windows\\System32\\*",
    "?:\\Windows\\SysWOW64\\*",
    "?:\\ProgramData\\*",
    "?:\\Users\\Public\\*",
    "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
    "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"
  ) and
  not process.executable : (
    "?:\\Program Files\\*",
    "?:\\Program Files (x86)\\*",
    "?:\\Windows\\system32\\cleanmgr.exe",
    "?:\\Windows\\system32\\msiexec.exe",
    "?:\\Windows\\syswow64\\msiexec.exe",
    "?:\\Windows\\system32\\svchost.exe",
    "?:\\Windows\\System32\\Robocopy.exe",
    "?:\\Windows\\SysWOW64\\Robocopy.exe"
  ) and
  not (process.executable : "?:\\Windows\\System32\\spoolsv.exe" and file.path : "?:\\Windows\\System32\\spool\\*") and
  not user.name : ("SYSTEM", "Local Service", "Network Service")