✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type == "deletion" and
  file.path : (
    "*.exe:Zone.Identifier",
    "*.exe:Zone.Identifier:$DATA",
    "*.msi:Zone.Identifier",
    "*.msi:Zone.Identifier:$DATA"
  ) and

  /* Explorer may remove MOTW after SmartScreen */
  not (
    process.executable : "?:\\Windows\\explorer.exe" and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : "Microsoft Windows"
  ) and

  /* Browsers may delete Zone.Identifier during download handling */
  not (
    process.code_signature.trusted == true and
    (
      (
        process.name : "chrome.exe" and
        process.code_signature.subject_name : "Google LLC"
      ) or
      (
        process.name : "msedge.exe" and
        process.code_signature.subject_name : "Microsoft Corporation"
      ) or
      (
        process.name : "firefox.exe" and
        process.code_signature.subject_name : "Mozilla Corporation"
      ) or
      (
        process.name : "brave.exe" and
        process.code_signature.subject_name : "Brave Software, Inc."
      )
    )
  )