Detect Archive via Library in Elastic Security

any where
  (
    event.category == "library" and
    dll.name in~ ("zlib.dll", "zlib1.dll", "zlibwapi.dll", "bzip2.dll", "libbzip2.dll", "libzip.dll", "minizip.dll") and
    not dll.path like~ "*System32*" and not dll.path like~ "*SysWOW64*" and
    not dll.path like~ "*7-Zip*" and not dll.path like~ "*WinRAR*" and
    not process.name in~ ("7z.exe", "7zG.exe", "WinRAR.exe", "msiexec.exe")
  ) or
  (
    event.category == "process" and event.type == "start" and
    process.name in~ ("powershell.exe", "pwsh.exe") and
    (
      process.command_line like~ "*IO.Compression*" or process.command_line like~ "*GZipStream*" or
      process.command_line like~ "*DeflateStream*" or process.command_line like~ "*ZipFile*" or
      process.command_line like~ "*ZipArchive*" or process.command_line like~ "*ICSharpCode*" or
      process.command_line like~ "*DotNetZip*"
    )
  ) or
  (
    event.category == "process" and event.type == "start" and
    process.name in~ ("python.exe", "python3.exe") and
    (
      process.command_line like~ "*import zlib*" or process.command_line like~ "*import bz2*" or
      process.command_line like~ "*import gzip*" or process.command_line like~ "*import zipfile*" or
      process.command_line like~ "*import rarfile*" or process.command_line like~ "*zlib.compress*" or
      process.command_line like~ "*import lzma*" or process.command_line like~ "*import tarfile*"
    )
  ) or
  (
    event.category == "file" and event.type == "creation" and
    (file.name like~ "*.gz" or file.name like~ "*.bz2" or file.name like~ "*.zlib" or
     file.name like~ "*.lzma" or file.name like~ "*.xz" or file.name like~ "*.lz") and
    (file.path like~ "*\\Temp\\*" or file.path like~ "*\\AppData\\*" or
     file.path like~ "*\\ProgramData\\*" or file.path like~ "*\\Users\\Public\\*") and
    process.name in~ ("python.exe", "python3.exe", "ruby.exe", "perl.exe", "node.exe",
                      "java.exe", "javaw.exe", "wscript.exe", "cscript.exe", "mshta.exe")
  )