✄𐘗
text code block:
✄𐘗event.category : network and host.os.type : (linux or macos or windows) and
dns.question.name : (
  iam.amazonaws.com or sts.amazonaws.com or bedrock*.amazonaws.com or kms.*.amazonaws.com or organizations.*.amazonaws.com or
  portal.sso.*.amazonaws.com or secretsmanager.*.amazonaws.com or ssm.*.amazonaws.com or sso.*.amazonaws.com or
  sts.*.amazonaws.com
) and
process.executable : (
  (
    *\\ProgramData\\* or *\\Users\\*\\AppData\\Local\\Temp\\* or *\\Users\\Public\\* or *\\Windows\\Temp\\* or
    /Users/*/Public/* or /Users/Shared/* or /dev/shm/* or /private/tmp/* or /run/* or /tmp/* or /var/run/* or
    /var/tmp/* or /var/www/*
  ) and
  not (/opt/actions-runner/* or /tmp/cargo-install* or /tmp/go-build* or /tmp/pytest-*)
) and
not (
  process.name: "MsSense.exe" and
  process.code_signature.subject_name : "Microsoft Windows Publisher" and process.code_signature.trusted : true
)