NetworkCleartext Logon by a Suspicious Process

authentication where event.action == "log_on" and
 process.Ext.session_info.logon_type == "NetworkCleartext" and process.executable : "C:\\*" and
 user.id like ("S-1-5-21*", "S-1-12-*") and (user.effective.id != null and user.effective.id like ("S-1-5-21*", "S-1-12-*")) and
 not (process.code_signature.trusted == true and
      process.code_signature.subject_name in ("Varonis Systems, Inc.", "Remote Access World SAS", "TSplus SAS", "Solarwinds Worldwide, LLC", "Siemens AG")) and
 not process.executable :
            ("?:\\Windows\\System32\\inetsrv\\w3wp.exe",
             "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe",
             "?:\\Windows\\System32\\inetsrv\\appcmd.exe",
             "?:\\Windows\\System32\\mmc.exe",
             "?:\\Windows\\System32\\wsmprovhost.exe",
             "?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\inetsrv\\InetMgr.exe",
             "?:\\Windows\\System32\\inetsrv\\WMSvc.exe",
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\System32\\CPrepSrv.exe",
             "?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe")