Based on the list at OHow and some from Ben Travis.
I would've used the 3 expressions at Travis' post but I don't have the time to check what they cover exactly, so I just carpet bombed it using the list from OHow.
It's split into 4 because of the 255 character limit.
If you're not sure how to use this follow the first or second link above, in the second link Ben makes a thorough explanation how to use this to filter both historical and incoming data, in the first link OHow goes through how you can make or update these expressions.