Could wholesale copy the existing regex to be honest, e.g.:
rewrite {
r ^([_0-9a-zA-Z-]+/)?files/(.+)
to wp-includes/ms-files.php?file={2}
}
Other than formatting the config in a rewrite block, the only modification required should be changing the capture group in the target from $2 to {2}, per the rewrite placeholder:
destinations… is one or more space-separated paths to rewrite to, with support for request placeholders as well as numbered regular expression captures such as {1}, {2}, etc.