JAVA Application Execution from Suspicious Paths

sequence by process.entity_id with maxspan=5s
[process where event.action == "start" and
  process.name : "javaw.exe" and process.args_count == 3 and process.args : "-jar" and
  process.args :
             ("C:\\Users\\*\\Downloads\\*.jar",
              "c:\\Users\\*\\Desktop\\*.jar",
              "C:\\Users\\*\\AppData\\Local\\Temp\\7z*\\",
              "C:\\Users\\*\\AppData\\Local\\Temp\\Rar$*\\*",
              "C:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*\\*",
              "C:\\Users\\*\\AppData\\Local\\Temp\\BNZ.*")
  ]
[network where event.action in ("connection_accepted", "connection_attempted") and
 not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8", "129.153.192.0/19", "128.194.0.0/16") and
 not (process.executable : "C:\\Program Files\\Amazon Corretto\\jdk*\\bin\\javaw.exe" and destination.ip == "164.154.131.141") and
 not (process.executable : "C:\\Program Files\\Zulu\\zulu-??\\bin\\javaw.exe" and destination.ip == "146.75.93.145")]