Office Application Startup via Template File Modification

file where event.action in ("creation", "overwrite") and process.pid != 4 and
  process.name != null and user.name != null and
  file.path :
    ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm",
     "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\PERSONAL.XLSB") and file.size > 0 and
  not process.thread.Ext.call_stack_summary in
                        ("sysfer.dll
| apphelp.dll
| kernelbase.dll
| migcore.dll
| loadstate.exe
| kernel32.dll
| ntdll.dll",
                         "ntdll.dll
| apphelp.dll
| kernelbase.dll
| migcore.dll
| loadstate.exe
| kernel32.dll
| ntdll.dll") and
  not process.executable : ("?:\\Windows\\System32\\svchost.exe",
                            "?:\\Windows\\explorer.exe",
                            "?:\\Program Files\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Citrix\\User Profile Manager\\UserProfileManager.exe",
                            "?:\\Program Files (x86)\\Ivanti\\Workspace Control\\pfwsmgr.exe",
                            "?:\\ProgramData\\ForensiT\\Transwiz\\Deployment Files\\Transwiz.exe",
                            "C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\User State Migration Tool\\amd64\\loadstate.exe",
                            "?:\\Windows\\Sys*\\xcopy.exe",
                            "?:\\Windows\\Sys*\\Robocopy.exe",
                            "?:\\Program Files\\Veeam\\Endpoint Backup\\*.exe",
                            "?:\\Program Files (x86)\\Laplink PCmover\\PCmoverHost.exe",
                            "?:\\Windows\\System32\\dllhost.exe",
                            "C:\\Windows\\System32\\cmd.exe",
                            "D:\\SuperGrate*.exe",
                            "\\Device\\Mup\\*.exe") and
  not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")