How to build ESA rule to detect inbound and outbound traffic from restrictive countries with executables

[EdPadilla]

Seeking assistance to build ESA rules for alerting/reporting on traffic from a list of restrictive countries say Russia, etc that it contents has executables like .exe, dll, bin, bat, VBS, JS, etc

Thanks