olafhartong-sysmon-modular/23_file_delete/include_user_writable_folders.xml

<Sysmon schemaversion="4.40">
   <EventFiltering>
      <RuleGroup name="" groupRelation="or">
         <FileDelete onmatch="include">
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Downloads\</TargetFilename>               <!--User Download folder-->
               <TargetFilename condition="contains any">.com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct</TargetFilename>
            </Rule>
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Appdata\Local\Temp\</TargetFilename>               <!--User Temp folder-->
               <TargetFilename condition="contains any">.com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct</TargetFilename>
            </Rule>
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\</TargetFilename>               <!--Microsoft Outlook Temp folder-->
            <Image condition="Contains">Downloads</Image>
            <Image condition="contains">Temp</Image>
            <Image condition="contains">AppData</Image>
            <Image condition="contains">ProgramData</Image>
            <Image condition="contains">Public</Image>
            <TargetFilename condition="contains">INetCache/Content.Outlook</TargetFilename>
            </Rule>
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Downloads\</TargetFilename> <!--User Download folder-->
               <TargetFilename condition="contains any">.com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct</TargetFilename>
            </Rule>
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Appdata\</TargetFilename> <!--User Temp folder-->
               <TargetFilename condition="contains any">.com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct</TargetFilename>
            </Rule>
            <Rule groupRelation="and">
               <TargetFilename condition="contains">\Appdata\Local\Microsoft\Windows\INetCache\Content.Outlook\</TargetFilename> <!--Microsoft Outlook Temp folder-->
               <TargetFilename condition="contains any">.com;.bat;.exe;.reg;.ps1;.vbs;.vba;.lnk;.doc;.xls;.hta;.bin;.7z;.dll;.xla;.cmd;.sh;.lnk;.pptm;.scr;.msi;.sct</TargetFilename>
            </Rule>
         </FileDelete>
      </RuleGroup>
   </EventFiltering>
</Sysmon>