Sensitive File Access - Unattended Panther

sequence by process.entity_id with maxspan=1m
   [process where event.action == "start" and
    user.id : ("S-1-5-21*", "S-1-12-*") and process.executable != null and
    process.hash.sha256 != "3e5bf6e2ac8ee4c7ccc60f51e5c4038ccf95b99f43f793b33b471681816a1d6b" and
    not process.executable :
          (
            /* third party programs common install path - requires local admin */
            "?:\\Program Files\\*",
            "?:\\Program Files (x86)\\*",

            /*
              dllhost.exe (IFileOperation like view/changing security permission of a file/folder).
              explorer.exe for directory and file discovery.
              SearchProtocolHost.exe is for file searches and indexing.
             */
            "?:\\Windows\\explorer.exe",
            "?:\\Windows\\System32\\dllhost.exe",
            "?:\\Windows\\System32\\SearchProtocolHost.exe",

            /* Windows Defender */
            "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
            "?:\\Program Files\\Microsoft Monitoring Agent\\Agent\\*.exe",
            "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",

            "?:\\Windows\\System32\\notepad.exe",
            "?:\\Windows\\System32\\Robocopy.exe",
            "?:\\Windows\\System32\\cmd.exe",
            "?:\\Windows\\System32\\xcopy.exe",
            "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe",
            "?:\\Windows\\System32\\smartscreen.exe",
            "?:\\Windows\\System32\\Sysprep\\sysprep.exe",
            "?:\\WINDOWS\\OEM\\FieryLocaleSetup.exe",
            "?:\\Windows\\System32\\pnputil.exe",
            "?:\\Windows\\System32\\ResetEngine.exe")]
   [file where event.type == "access" and
    /* non system accounts */
    user.id : ("S-1-5-21*", "S-1-12-*") and
    file.path : ("?:\\Windows\\Panther\\Unattend.xml",
                 "?:\\Windows\\Panther\\Unattended.xml",
                 "?:\\Windows\\Panther\\Unattend\\Unattended.xml",
                 "?:\\Windows\\Panther\\Unattend\\Unattend.xml",
                 "?:\\Windows\\System32\\Sysprep\\unattend.xml",
                 "?:\\Windows\\System32\\Sysprep\\Panther\\unattend.xml")]