Failed Attempts to Access Sensitive Files

any where event.category in ("registry", "file") and
   event.action in ("query", "open") and event.outcome == "failure" and process.pid != 4 and
   process.executable != null and
   (
    (file.path : "?:\\*" and
     file.path :
	     (
		  "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings",
		  "?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
		  "?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
		  "?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") and
	 not process.executable :
	          ("?:\\Program Files\\*",
	           "?:\\Program Files (x86)\\*",
	           "?:\\Windows\\System32\\SearchProtocolHost.exe",
	           "?:\\Windows\\System32\\svchost.exe",
	           "?:\\Windows\\System32\\OpenSSH\\ssh.exe", 
	           "?:\\Windows\\System32\\OpenSSH\\ssh-keygen.exe",
	           "?:\\Windows\\System32\\OpenWith.exe", 
	           "\\Device\\Mup*",
	           "?:\\Windows\\explorer.exe",
	           "?:\\Windows\\eMweb\\certutil.exe") and
	 not (process.code_signature.subject_name :
	          ("Rapid7 LLC", "Mozilla Corporation", "Commvault Systems, Inc.", "Google LLC", "Bitdefender SRL",
	           "McAfee, Inc.", "Serengeti Systems Incorporated", "nordvpn s.a.", "Kaspersky Lab", "JetBrains s.r.o.", 
	           "Illusive Networks LTD", "Ghisler Software GmbH", "Keeper Security Inc.", "Eric R. Zimmerman", 
	           "Galactic Advisors, Inc.", "Johannes Schindelin", "Mobatek", "Shift Technologies Inc.",
	           "Viber Media S.a r.l.", "ONELAUNCH TECHNOLOGIES INC.", "SAP SE") and
         process.code_signature.trusted == true) and
     not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
         user.id == "S-1-5-18" and process.code_signature.trusted == true) and
     not (file.name : "RDCMan.settings" and process.name : ("RDCMan.exe", "RDCMan-x86.exe"))
     ) or

	(registry.path :
         ("HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword", 
	  "HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*") and

	not (process.code_signature.trusted == true and
	     process.code_signature.subject_name :
	        ("Simon Tatham", "Tim Kosse", "David Sparer", "Martin Prikryl", "Open Source Developer, Sven Strickroth",
	         "Astrospark Technologies, LLC", "Solarwinds Worldwide, LLC", "NETSUPPORT LTD.", "Bitdefender SRL",
	         "Ivanti, Inc.", "Fortinet Technologies*", "Ivanti, Inc.")) and
	not process.executable : "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe")
    )