Sensitive File Access - System Admin Utilities

sequence by process.entity_id with maxspan=5m
   [process where event.action == "start" and
    user.id like ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",
            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",
            "?:\\Windows\\regedit.exe",
            "?:\\Windows\\system32\\reg.exe",
            "?:\\Windows\\System32\\userinit.exe",
            "?:\\Windows\\System32\\notepad.exe",
            "?:\\Windows\\System32\\Robocopy.exe",
            "?:\\Windows\\System32\\cmd.exe",
            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
            "?:\\Windows\\_ScriptingFramework\\Modul\\Engine.exe",

            /* lot of legit access from mounted sysadmin file shares */
            "\\Device\\Mup\\*.exe") and
    not (process.code_signature.subject_name :
                      ("Martin Prikryl",
                       "OpenVPN Technologies, Inc.",
                       "TeamViewer Germany GmbH",
                       "Open Source Developer, Dominik Reichl",
                       "Tim Kosse",
                       "TEFINCOM S.A.",
                       "nordvpn s.a.") and
          process.code_signature.trusted == true)
   ]
   [any where event.category in ("registry", "file") and
    event.action in ("query", "open") and
    (
     file.path : ("?:\\Users\\*\\AppData\\Roaming\\KeePass\\KeePass.config.xml",
                  "?:\\Users\\*\\AppData\\*\\NordVPN\\NordVPN.exe*\\user.config",
                  "?:\\Users\\*\\AppData\\*\\FileZilla\\recentservers.xml",
                  "?:\\Users\\*\\AppData\\*\\FileZilla\\sitemanager.xml") or
     registry.path : ("HKEY_USERS\\S-1-5-21*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
                      "HKEY_USERS\\S-1-5-21*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
                      "HKEY_USERS\\S-1-5-21*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*",
                      "HKEY_USERS\\S-1-12-1-*\\software\\Martin Prikryl\\WinSCP *\\Sessions\\*\\Password*",
                      "HKEY_USERS\\S-1-12-1-*\\SOFTWARE\\WOW6432Node\\TeamViewer\\ProxyPassword",
                      "HKEY_USERS\\S-1-12-1-*\\Software\\OpenVPN-GUI\\Configs\\*auth-data*")
     ) and
      /* unsigned KeePass */
     not (process.name : "KeePass.exe" and file.name : "KeePass.config.xml")]