Sigma Rule Filtering "OR"

[SecOps56]

Is there a way to add an OR option into your sigma rule filter?

I would like to have multiple sigma filters, but only actual sigma filter applies to the rule itself so is there an option to create an OR in that single filter?

[defensivedepth]

Can you give a practical example of what you are trying to do?

[SecOps56]

Example: With the alert "Driver Load From A Temporary Directory" I can create an exclusion rule to allow certain executables that I know should be preforming this activity, but there are a few executables like powershell.exe where it may or may not be normal activity. I would like to put an option in my exclusion where I can list executables that are allowed and also exclude PowerShell events that are using specific temporary directories.