Potential Binary Masquerading via Invalid Code Signature

process where event.action == "exec" and
 (
   process.name like ("com.apple.*", "com.jamf.*", "jamf*", "zoom.us") or 
   process.executable like "/Users/*/Library/com.apple.*"
  ) and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not (process.code_signature.subject_name in ("Software Signing", "com.apple.WebKit.Networking", "com.apple.WebKit.WebContent") and
      process.name in
           ("com.apple.WebKit.WebContent.Development",
            "com.apple.WebKit.GPU.Development",
            "com.apple.WebKit.Networking.Development",
            "com.apple.WebKit.Storage.Development")) and
 not process.executable like~ ("/usr/local/jamf/bin/jamf", "com.apple.WebKit.Networking.Development", "/Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistLauncher",
                           "/Library/Application Support/JAMF/Remote Assist/jamfRemoteAssistConnectorUI.app/Contents/MacOS/jamfRemoteAssistConnectorUI",
                           "/Users/*/Library/Caches/ms-playwright/*") and
 not process.parent.executable in ("/sbin/launchd", "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon") and
 not process.Ext.effective_parent.executable in ("/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
                                                "/System/Library/PrivateFrameworks/CoreSpeech.framework/corespeechd") and
 not (process.Ext.effective_parent.executable == "/Applications/Visual Studio Code.app/Contents/MacOS/Electron" and process.name == "com.apple.WebKit.WebContent.Development") and
 not (process.code_signature.signing_id in ("com.apple.WebKit.WebContent", "us.zoom.xos") and process.code_signature.trusted == true) and
 not (process.name == "zoom.us" and process.code_signature.subject_name == "Developer ID Application: Zoom Video Communications, Inc. (BJ4HAAB9B3)" and process.code_signature.team_id == "BJ4HAAB9B3") and
 not process.hash.sha256 in ("7519ac10c724566b7a57607cc2fc88a876bdd91a585e690c2480093b582c73e6", "930b075c52f829efcd431cee324403e1e8b03bf2039b1343aae31570034d30e2")