Sensitive File Access - Remote Desktop Connection Manager

file where event.type == "access" and event.outcome == "success" and
    /* domain user RID */
    user.id : ("S-1-5-21*", "S-1-12-*") and process.pid != 4 and
    file.path : "?:\\Users\\*\\AppData\\Local\\*\\Remote Desktop Connection Manager\\RDCMan.settings" and
    not process.executable :
                    ("?:\\Program Files (x86)\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe",
                     "?:\\Program Files\\Microsoft\\Remote Desktop Connection Manager\\RDCMan.exe") and
    not (process.name : ("RDCMan.exe", "RDCMan-x86.exe", "RemoteDesktopManager.exe") and process.code_signature.subject_name like "Microsoft *" and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name == "Fortinet, Inc." and process.code_signature.trusted == true)