file where host.os.type == "windows" and event.type == "creation" and

  file.path : "C:\\*:*" and
  not file.path : 
          ("C:\\*:zone.identifier*",
           "C:\\users\\*\\appdata\\roaming\\microsoft\\teams\\old_weblogs_*:$DATA",
           "C:\\Windows\\CSC\\*:CscBitmapStream") and

  not process.executable : (
          "?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
          "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\EXCEL.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\POWERPNT.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\WINWORD.EXE",
          "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
          "?:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe",
          "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Program Files\\Microsoft Office\\root\\*\\EXCEL.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\POWERPNT.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\WINWORD.EXE",
          "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
          "?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe",
          "?:\\Program Files\\Rivet Networks\\SmartByte\\SmartByteNetworkService.exe",
          "?:\\Windows\\explorer.exe",
          "?:\\Windows\\System32\\DataExchangeHost.exe",
          "?:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnectivityNetworkService.exe",
          "?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\KillerNetworkService.exe",
          "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
          "?:\\Windows\\System32\\PickerHost.exe",
          "?:\\Windows\\System32\\RuntimeBroker.exe",
          "?:\\Windows\\System32\\SearchProtocolHost.exe",
          "?:\\Windows\\System32\\sihost.exe",
          "?:\\windows\\System32\\svchost.exe",
          "?:\\Windows\\System32\\WFS.exe"
  ) and

  file.extension :
    (
      "pdf", "dll", "exe", "dat", "com", "bat", "cmd", "sys", "vbs", "ps1", "hta", "txt", "vbe", "js",
      "wsh", "docx", "doc", "xlsx", "xls", "pptx", "ppt", "rtf", "gif", "jpg", "png", "bmp", "img", "iso"
    )