✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type != "deletion" and
  file.extension : "spl" and
  file.path : "?:\\Windows\\System32\\spool\\PRINTERS\\*" and
  not process.name : ("spoolsv.exe",
                      "printfilterpipelinesvc.exe",
                      "PrintIsolationHost.exe",
                      "splwow64.exe",
                      "msiexec.exe",
                      "poqexec.exe",
                      "System") and
  not user.id : "S-1-5-18" and
  not process.executable :
            ("?:\\Windows\\System32\\mmc.exe",
             "\\Device\\Mup\\*.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\System32\\printui.exe",
             "?:\\Windows\\System32\\mstsc.exe",
             "?:\\Windows\\System32\\spool\\*.exe",
             "?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\PROGRA~1\\*.exe",
             "?:\\PROGRA~2\\*.exe",
             "?:\\Windows\\System32\\rundll32.exe",
             "?:\\Windows\\explorer.exe",
             "?:\\Windows\\System32\\mspaint.exe",
             "?:\\Windows\\System32\\SnippingTool.exe",
             "?:\\Windows\\System32\\notepad.exe",
             "?:\\Windows\\System32\\xpsrchvw.exe",
             "?:\\Program Files\\LibreOffice\\program\\soffice.bin",
             "?:\\Program Files (x86)\\LibreOffice\\program\\soffice.bin") and

  /* Signed Browsers */
  not (
    process.name : ("chrome.exe", "firefox.exe", "brave.exe", "opera.exe", "msedge.exe") and
    process.code_signature.trusted == true and
    process.code_signature.subject_name : (
      "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Opera Norway AS", "Microsoft Corporation"
    )
  )