Crypto Wallet File Access by Unsigned or Untrusted Binary

file where event.action == "open" and 
 file.path like~ ("/Users/*/.electrum/*",
                  "/Users/*/Library/Application_Support/*/Default/Extensions/*",
                  "/Users/*/Library/Application Support/*/Default/Local Extension Settings/*",
                  "/Users/*/Library/Application Support/Electrum/*",
                  "/Users/*/Library/Application Support/Exodus/*", 
                  "/Users/*/Library/Application Support/Coinomi/*",
                  "/Users/*/Library/Application Support/Atomic/*",
                  "/Users/*/Library/Application Support/@trezor/*",
                  "/Users/*/Library/Application Support/Ledger Live/*",
                  "/Users/*/Library/Application Support/WasabiWallet/*",
                  "/Users/*/Monero/*",
                  "/Users/*/Library/Application Support/Bitcoin/*",
                  "/Users/*/Library/Application Support/Litecoin/*",
                  "/Users/*/Library/Application Support/DashCore/*",
                  "/Users/*/Library/Application Support/ElectronCash/*",
                  "/Users/*/Library/Application Support/Guarda/*",
                  "/Users/*/Library/Application Support/Dogecoin/*",
                  "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/BraveWallet/*",
                  "/Users/*/Library/Application Support/BraveSoftware/Brave-Browser/Default/Local Extension Settings/pgojbichloddijphfmfhhfolimnhjklk/*",
                  "/Users/*/Library/Application Support/Firefox/Profiles/*/extensions/*") and
  process.executable != null and
  (process.code_signature.trusted == false or process.code_signature.exists == false) and
  not process.code_signature.signing_id : ("rg-*", "git-*", "rg") and
  not process.executable like "/opt/homebrew/Cellar/rtk/*/bin/rtk" and
  not (Effective_process.executable like "/Library/Elastic/Agent/data/elastic-agent-*/elastic-agent.app/Contents/MacOS/elastic-agent" and process.executable like "/Library/Elastic/Agent/data/elastic-agent-*/components/osquery-extension.ext")