✄𐘗
text code block:
✄𐘗sequence with maxspan=1m
  [file where host.os.type == "windows" and event.type in ("creation", "change") and 
   process.pid == 4 and (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by host.id, file.path
  [process where host.os.type == "windows" and event.type == "start" and
    not (
      (
        process.code_signature.trusted == true and
        process.code_signature.subject_name : (
              "Veeam Software Group GmbH",
              "Elasticsearch, Inc.",
              "PDQ.com Corporation",
              "CrowdStrike, Inc.",
              "Microsoft Windows Hardware Compatibility Publisher",
              "ZOHO Corporation Private Limited",
              "BeyondTrust Corporation", 
              "CyberArk Software Ltd.", 
              "Sophos Ltd"
        )
      ) or
      (
        process.executable : (
          "?:\\Windows\\ccmsetup\\ccmsetup.exe",
          "?:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta*.exe",
          "?:\\Windows\\CAInvokerService.exe"
        ) and process.code_signature.trusted == true
      ) or
      (
        process.executable : "G:\\SMS_*\\srvboot.exe" and 
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation"
      )
    )
  ] by host.id, process.executable