Potential Browser Information Discovery

file where event.action == "open" and 
process.executable != null and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.pid != 4 and
 file.path :
     ("?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History",
      "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Bookmarks",
      "?:\\users\\*\\appdata\\local\\microsoft\\edge\\user data\\default\\History",
      "?:\\users\\*\\appdata\\local\\microsoft\\edge\\user data\\default\\Bookmarks",
      "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.default*\\places.sqlite",
      "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*.default*\\formhistory.sqlite") and
 process.thread.Ext.call_stack_summary : "?*" and
 (
  (process.code_signature.trusted == false and not process.code_signature.status : ("errorExpired", "errorCode_endpoint*")) or
  process.code_signature.exists == false or
  (process.code_signature.subject_name : "Microsoft*" and process.thread.Ext.call_stack_contains_unbacked == true and not process.name : "powershell.exe") or
  process.executable :
                ("?:\\Users\\Public\\*",
                 "?:\\Users\\*\\Downloads\\*",
                 "?:\\Windows\\Temp\\*",
                 "?:\\Windows\\Tasks\\*",
                 "?:\\ProgramData\\*",
                 "?:\\Windows\\Microsoft.NET\\*")
 ) and
 not (process.code_signature.subject_name : ("Google LLC", "Mozilla Corporation", "BrowserWorks Ltd", "SAP SE", "Time Doctor LLC", "Emsisoft Ltd", "PIRIFORM SOFTWARE LIMITED") and
      process.code_signature.trusted == true) and
 not (process.code_signature.subject_name : "Shift Technologies Inc." and process.code_signature.status : "errorUntrustedRoot") and 
 not process.executable :
                  ("?:\\Program Files (x86)\\*.exe",
                   "?:\\Program Files\\*.exe",
                   "?:\\Windows\\System32\\svchost.exe",
                   "?:\\Windows\\BitLockerDiscoveryVolumeContents\\BitLockerToGo.exe",
                   "?:\\Users\\*\\User Data\\Default\\mozilla_downloads.exe",
                   "?:\\Users\\*\\User Data\\Default\\chrome_downloads.exe",
                   "?:\\Users\\*\\User Data\\Default\\msedge_downloads.exe",
                   "?:\\Users\\*\\AppData\\Local\\Chromium\\Application\\chrome.exe",
                   "?:\\Users\\*\\AppData\\Local\\Thorium\\Application\\thorium.exe") and
 not (process.executable : "C:\\Windows\\Temp\\RarSFX*\\scanstate.exe" and
      process.thread.Ext.call_stack_summary == "ntdll.dll
| sophosed.dll
| apphelp.dll
| kernelbase.dll
| migcore.dll
| migstore.dll
| migcore.dll
| scanstate.exe
| kernel32.dll
| ntdll.dll") and
 not (process.executable : "C:\\Windows\\explorer.exe" and
      process.thread.Ext.call_stack_summary : "ntdll.dll
| kernelbase.dll
| hostshellextension.dll
| Unbacked") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                     $entry.symbol_info : ("*\\chrome.dll!GetHandleVerifier*",
                                           "*\\chrome.dll!ChromeMain*",
                                           "*\\nw.dll!sqlite3_dbdata_init*",
                                           "*\\nw.dll!GetHandleVerifier*",
                                           "*\\BrowserSettings.dll!SetEdgeAsDefaultBrowserOnWin8Beyond*",
                                           "*\\chrome.dll!IsSandboxedProcess*",
                                           "*BrowserSettings.dll!SetEdgeAsDefaultBrowserOnWin*"))