✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type == "creation" and

  file.path : "C:\\*:*" and file.extension in~ (
    "pdf", "dll", "exe", "dat", "com", "bat", "cmd", "sys", "vbs", "ps1", "hta", "txt", "vbe", "js",
    "wsh", "docx", "doc", "xlsx", "xls", "pptx", "ppt", "rtf", "gif", "jpg", "png", "bmp", "img", "iso"
  ) and

  not file.path : 
          ("C:\\*:zone.identifier*",
           "C:\\users\\*\\appdata\\roaming\\microsoft\\teams\\old_weblogs_*:$DATA",
           "C:\\Windows\\CSC\\*:CscBitmapStream") and

  not process.executable : (
          "?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
          "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\EXCEL.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\POWERPNT.EXE",
          "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\WINWORD.EXE",
          "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
          "?:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe",
          "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
          "?:\\Program Files\\Microsoft Office\\root\\*\\EXCEL.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\POWERPNT.EXE",
          "?:\\Program Files\\Microsoft Office\\root\\*\\WINWORD.EXE",
          "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
          "?:\\Program Files\\Windows Defender Advanced Threat Protection\\MsSense.exe",
          "?:\\Program Files\\Rivet Networks\\SmartByte\\SmartByteNetworkService.exe",
          "?:\\Windows\\explorer.exe",
          "?:\\Windows\\System32\\DataExchangeHost.exe",
          "?:\\Windows\\System32\\drivers\\Intel\\ICPS\\IntelConnectivityNetworkService.exe",
          "?:\\Windows\\System32\\drivers\\RivetNetworks\\Killer\\KillerNetworkService.exe",
          "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
          "?:\\Windows\\System32\\PickerHost.exe",
          "?:\\Windows\\System32\\RuntimeBroker.exe",
          "?:\\Windows\\System32\\SearchProtocolHost.exe",
          "?:\\Windows\\System32\\sihost.exe",
          "?:\\windows\\System32\\svchost.exe",
          "?:\\Windows\\System32\\WFS.exe"
  ) and
  
  not (
    ?process.code_signature.trusted == true and
    file.name : "*:sec.endpointdlp:$DATA"
  )