Potential Data wiping Attack Behavior

sequence by process.entity_id with maxspan=1s

  /* a sequence of file mod by same process */

 [file where event.action == "modification" and process.pid != 4 and process.executable != null and 
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10 and
  not process.executable :
            ("?:\\Program Files\\*.exe",
             "?:\\Program Files (x86)\\*.exe",
             "?:\\Windows\\System32\\spoolsv.exe",
             "?:\\Windows\\System32\\svchost.exe",
             "?:\\Windows\\Explorer.exe",
             "?:\\Program Files (x86)\\Steam\\steamapps\\*.exe",
             "\\Device\\HarddiskVolume?\\Steam\\steam.exe") and
  not (process.name : "steam.exe" and file.path : "?:\\Users\\*\\steamapps\\downloading\\*.txt") and
  not (process.code_signature.subject_name : "Valve Corp." and process.code_signature.trusted == true) and
  not file.path : "?:\\Program Files (x86)\\Steam\\steamapps\\downloading\\*" and
  not (file.extension : ("dll", "exe", "txt") and process.executable : "C:\\Windows\\System32\\msiexec.exe") and
  not (process.executable : "C:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
       process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
  ]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]
 [file where event.action == "modification" and
  file.Ext.entropy == 0 and file.Ext.header_bytes : "0000000*" and
  file.extension : ("exe", "dll", "html", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "pdf", "txt", "png") and file.size > 10]