Sensitive File Access - Cloud Credentials

sequence by process.entity_id with maxspan=5m
   [process where event.action == "start" and
    user.id like ("S-1-5-21*", "S-1-12-*") and process.executable != null and 
    not (process.code_signature.subject_name : ("Johannes Schindelin", "Anaconda, Inc.") and process.code_signature.status == "trusted") and
    not (process.code_signature.subject_name : "Python Software Foundation" and
         process.executable : "?:\\Users\\*\\AppData\\Local\\Google\\Cloud SDK\\google-cloud-sdk\\platform\\bundledpython\\python.exe") and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",

            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",

            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe") and
    process.hash.sha256 != "0a8876ede7d2b65a5a0443831b2b4757d3519396a22bd55c20102bc67e6d16b3"]
   [file where event.type == "access" and
    /* non system accounts */
    user.id like ("S-1-5-21*", "S-1-12-*") and

    /* AWS/Google/Azure/Git cloud credential files */
    file.path : ("?:\\users\\*\\AppData\\*\\gcloud\\credentials.db",
                 "?:\\users\\*\\AppData\\*\\gcloud\\legacy_credentials",
                 "?:\\users\\*\\AppData\\*\\gcloud\\access_tokens.db",
                 "?:\\users\\*\\.azure\\accessTokens.json",
                 "?:\\users\\*\\.azure\\azureProfile.json",
                 "?:\\users\\*\\.azure\\msal_token_cache.json",
                 "?:\\users\\*\\.azure\\msal_token_cache.bin",
                 "?:\\users\\*\\.azure\\msal_http_cache.bin",
                 "?:\\users\\*\\.aws\\credentials",
                 "?:\\Users\\*\\.config\\git\\credentials")]