✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type != "deletion" and file.extension : ("aspx", "ashx", "asmx") and
 process.name : ("w3wp.exe", "MSExchangeMailboxReplication.exe", "EdgeTransport.exe", "Microsoft.Exchange.*.exe", "UMWorkerProcess.exe", "umservice.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "xcopy.exe") and 
  (
   (file.path : ("?:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\\TEMPLATE\\LAYOUTS\\*",
                 "?:\\inetpub\\wwwroot\\aspnet_client\\system_web\\*", 
                 "?:\\Program Files\\Microsoft\\Exchange Server\\V*\\FrontEnd\\HttpProxy\\owa\\auth\\*", 
                 "?:\\Program Files\\Microsoft\\Exchange Server\\V*\\FrontEnd\\HttpProxy\\ecp\\auth\\*") and 
    /* not sub-dirs */
    not file.path : ("?:\\inetpub\\wwwroot\\aspnet_client\\system_web\\*\\*", 
                     "?:\\Program Files\\Microsoft\\Exchange Server\\V*\\FrontEnd\\HttpProxy\\*\\auth\\*\\*", 
                     "?:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\*\\TEMPLATE\\LAYOUTS\\*\\*")) or 

    /* not sub-dirs */
   (file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" and not file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*\\*")
  )