Potential Credential Access via Windows Credential History

file where event.action == "open" and
   /* Credentials History */
  file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST" and
  user.id : ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
  /* third party programs and noisy native system processes */
  not process.executable :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\lsass.exe",
           "?:\\Windows\\System32\\svchost.exe",
           "?:\\Windows\\System32\\Robocopy.exe",
           "?:\\Windows\\ccmcache\\*.exe",
           "?:\\Windows\\CCM\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\Windows\\System32\\WerFault.exe",
           "?:\\Windows\\SysWOW64\\WerFault.exe",
           "?:\\Windows\\System32\\dllhost.exe",
           "?:\\Windows\\System32\\sdclt.exe",
           "?:\\Windows\\System32\\PickerHost.exe",
           "?:\\Windows\\System32\\MRT.exe",
           "?:\\Windows\\System32\\xcopy.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\find.exe",
           "?:\\Users\\*\\git\\usr\\bin\\grep.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\*\\resources\\app\\node_modules\\@vscode\\ripgrep\\bin\\rg.exe",
           "?:\\Windows\\System32\\Dism.exe") and
  not (process.code_signature.subject_name in ("ForensiT Limited", "Anysphere, Inc.", "Anthropic, PBC", "Open Source Developer, Bryan Berns", "JetBrains s.r.o.", "QUICK HEAL TECHNOLOGIES LIMITED") and process.code_signature.trusted == true)