Access to Windows Passwords Vault by Unusual Process

any where event.category == "iam" and event.action in ("vault_credentials_read", "vault-credentials-were-read") and
 process.parent.executable != null and user.id != "S-1-5-18" and process.executable != null and
 (process.code_signature.trusted == false or
  process.code_signature.exists == false or
  process.code_signature.subject_name in ("Microsoft Corporation", "Microsoft Windows")) and
 not (process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and process.executable : "?:\\Windows\\*.exe") and
 not (process.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\sppsvc.exe") and process.parent.executable : "?:\\Windows\\System32\\services.exe") and
 not (process.executable : "C:\\Windows\\System32\\msiexec.exe" and process.parent.executable : "C:\\Windows\\System32\\msiexec.exe") and
 not (process.name : "rundll32.exe" and process.command_line : "*inetcpl.cpl,ClearMyTracksByProcess*") and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe")) and
 not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and process.parent.executable : ("?:\\Windows\\System32\\rundll32.exe", "?:\\Windows\\System32\\cmd.exe")) and
 not (process.executable : "?:\\Windows\\System32\\backgroundTaskHost.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and
 not (process.executable : "C:\\Windows\\explorer.exe" and process.parent.executable : "C:\\Windows\\System32\\userinit.exe") and
 not process.executable :
                ("?:\\Program Files\\*.exe",
                 "?:\\Program Files (x86)\\*.exe",
                 "?:\\Windows\\System32\\conhost.exe",
                 "?:\\ProgramData\\Motorola Solutions\\Flex\\application\\FlexClient\\FlexClient.exe") and
 not process.parent.executable :
                           ("C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
                            "C:\\Program Files (x86)\\Microsoft Intune Management Extension\\AgentExecutor.exe",
                            "C:\\Program Files\\WindowsApps\\KeeperSecurityInc.KeeperPasswordManager_*\\app\\keeperpasswordmanager.exe",
                            "C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\officesvcmgr.exe") and
 not (process.executable : ("C:\\Users\\*\\AppData\\Local\\PowerToys\\WinUI3Apps\\PowerToys.*.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\OneDriveActionHelper.exe",
                            "C:\\Users\\*\\AppData\\Local\\Microsoft\\Edge SxS\\Application\\msedge.exe") and
      process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)