✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and event.type == "start" and
  process.name : "mofcomp.exe" and process.args : "*.mof" and
  not user.id : "S-1-5-18" and
  not process.args : (
    "?:\\Program Files (x86)\\Microsoft Power BI Report Server\\*.mof",
    "?:\\Program Files (x86)\\Microsoft SQL Server Reporting Services\\*.mof",
    "?:\\Program Files (x86)\\Microsoft SQL Server\\*.mof",
    "?:\\Program Files\\Microsoft Policy Platform\\*.mof",
    "?:\\Program Files\\Microsoft Power BI Report Server\\*.mof",
    "?:\\Program Files\\Microsoft SQL Server Reporting Services\\*.mof",
    "?:\\Program Files\\Microsoft SQL Server\\*.mof",
    "?:\\Windows\\System32\\wbem\\com.hp.provider.*.mof",
    "?:\\Windows\\System32\\wbem\\CxAudioSvc_*.mof",
    "?:\\Windows\\System32\\wbem\\Framework\\root\\*.mof",
    "?:\\Windows\\System32\\wbem\\Veeam.Backup.*.mof",
    "?:\\Windows\\System32\\wbem\\ZTITatoo.mof",
    "?:\\Windows\\SysWOW64\\wbem\\Framework\\root\\*.mof"
  )