✄𐘗
text code block:
✄𐘗file where host.os.type == "windows" and event.type : "creation" and
(
  /* Firefox-Based Browsers */
  (
    file.name : "*.xpi" and
    file.path : "?:\\Users\\*\\AppData\\Roaming\\*\\Profiles\\*\\Extensions\\*.xpi" and
    not
    (
      process.name : "firefox.exe" and
      file.name : (
        "langpack-*@firefox.mozilla.org.xpi",
        "*@dictionaries.addons.mozilla.org.xpi",
        "newtab@mozilla.org.xpi",
        "uBlock0@raymondhill.net.xpi",
        /* AdBlockPlus */
        "{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi",
        /* Bitwarden */
        "{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi",
        "addon@darkreader.org.xpi",
        /* 1Password */
        "{d634138d-c276-4fc8-924b-40a0ea21d284}.xpi",
        "support@lastpass.com.xpi",
        /* Grammarly */
        "87677a2c52b84ad3a151a4a72f5bd3c4@jetpack.xpi",
        "sentinelone_visibility@sentinelone.com.xpi",
        "keepassxc-browser@keepassxc.org.xpi"
      )
    )
  ) or
  /* Chromium-Based Browsers */
  (
    file.name : "*.crx" and
    file.path : "?:\\Users\\*\\AppData\\Local\\*\\*\\User Data\\Webstore Downloads\\*"
  )
)