file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
  file.name : ("amsi.dll", "amsi") and
  not file.path : (
    "?:\\$SysReset\\CloudImage\\Package_for_RollupFix*",
    "?:\\Windows\\system32\\amsi.dll",
    "?:\\Windows\\Syswow64\\amsi.dll",
    "?:\\$WINDOWS.~BT\\DUImageSandbox\\*",
    "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*",
    "?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*",
    "?:\\$WINDOWS.~BT\\Work\\*\\*",
    "?:\\$WINDOWS.~BT\\Store\\Offline\\File\\C$\\Windows\\SoftwareDistribution\\Download.bak\\*",
    "?:\\Windows\\CbsTemp\\*\\f\\amsi.dll",
    "?:\\Windows\\SoftwareDistribution\\Download\\*",
    "?:\\Windows\\WinSxS\\amd64_microsoft-antimalware-scan-interface_*\\amsi.dll"
  ) and
  not
  (
    process.executable : "C:\\Windows\\System32\\wbengine.exe" and
    file.path : (
      "\\Device\\HarddiskVolume??\\Windows\\system32\\amsi.dll",
      "\\Device\\HarddiskVolume??\\Windows\\syswow64\\amsi.dll",
      "\\Device\\HarddiskVolume??\\Windows\\WinSxS\\*\\amsi.dll",
      "\\\\?\\Volume{*}\\Windows\\WinSxS\\*\\amsi.dll",
      "\\\\?\\Volume{*}\\Windows\\system32\\amsi.dll",
      "\\\\?\\Volume{*}\\Windows\\syswow64\\amsi.dll"
    )
  )