✄𐘗
text code block:
✄𐘗process where host.os.type == "windows" and
  event.type == "start" and 
  not process.code_signature.status like "errorCode_endpoint*" and process.hash.sha256 != null and 
  (
    /* Slack */
    (process.name : "slack.exe" and not
      (process.code_signature.subject_name : (
        "Slack Technologies, Inc.",
        "Slack Technologies, LLC"
       ) and process.code_signature.trusted == true)
    ) or

    /* WebEx */
    (process.name : "WebexHost.exe" and not
      (process.code_signature.subject_name : ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
    ) or

    /* Teams */
    (process.name : "Teams.exe" and not
      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true) and 
      process.executable != "C:\\Program Files (x86)\\Teams Installer\\Teams.exe"
    ) or

    /* Discord */
    (process.name : "Discord.exe" and not
      (process.code_signature.subject_name : "Discord Inc." and process.code_signature.trusted == true)
    ) or

    /* RocketChat */
    (process.name : "Rocket.Chat.exe" and not
      (process.code_signature.subject_name : "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true) and 
      process.executable != "C:\\Program Files\\rocketchat\\Rocket.Chat.exe"
    ) or

    /* Mattermost */
    (process.name : "Mattermost.exe" and not
      (process.code_signature.subject_name : "Mattermost, Inc." and process.code_signature.trusted == true)
    ) or

    /* WhatsApp */
    (process.name : "WhatsApp.exe" and not
      (process.code_signature.subject_name : (
        "WhatsApp LLC",
        "WhatsApp, Inc",
        "24803D75-212C-471A-BC57-9EF86AB91435"
       ) and process.code_signature.trusted == true)
    ) or

    /* Zoom */
    (process.name : "Zoom.exe" and not
      (process.code_signature.subject_name : (
        "Zoom Video Communications, Inc.",
        "Zoom Communications, Inc."
       ) and process.code_signature.trusted == true)
    ) or

    /* Outlook */
    (process.name : "outlook.exe" and not
      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
    ) or

    /* Thunderbird */
    (process.name : "thunderbird.exe" and not
      (process.code_signature.subject_name : "Mozilla Corporation" and process.code_signature.trusted == true)
    )
  )