✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type == "creation" and file.extension : "exe" and
  file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" and
  not (
      process.executable : (
          "?:\\Windows\\System32\\msiexec.exe",
          "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
          "*\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe"
      ) and
      file.path : ("?:\\Program Files\\QGIS *\\apps\\grass\\*.exe", "\\Device\\HarddiskVolume*\\Program Files\\QGIS *\\apps\\grass\\*.exe")
  ) and 
  not process.executable : 
                             ("C:\\Program Files\\dotnet\\dotnet.exe", 
                              "C:\\Program Files\\Microsoft Visual Studio\\*.exe",
                              "\\Device\\HarddiskVolume*\\Program Files\\dotnet\\dotnet.exe", 
                              "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Visual Studio\\*.exe")