Suspicious Browser Files Modification

any where event.category in ("file", "registry") and not event.action in ("deletion", "query") and
   (process.code_signature.trusted == false or process.code_signature.exists == false) and
   not user.id in ("S-1-5-18", "S-1-5-19") and
   not process.code_signature.status == "errorExpired" and
   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*", "E:\\Migwiz\\migwiz.exe") and
   (
     registry.path  : "HK*SOFTWARE\\Policies\\*\\ExtensionInstallWhitelist*" or

	 file.path :
	        ("?:\\Users\\*\\AppData\\Roaming\\Mozilla\\*\\Profiles\\*default*\\extensions.json",
	         "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\*\\Profiles\\*default*\\prefs.js",
	         "?:\\Users\\*\\AppData\\Local\\*\\User Data\\Default\\Extensions\\*.js")
	) and
	not file.Ext.header_bytes : "2f2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a" and
	not (process.code_signature.subject_name == "WAVESOR SOFTWARE" and process.code_signature.status ==  "errorChaining" and
	     process.executable : "?:\\Users\\*\\Wavesor Software\\WaveBrowser\\wavebrowser.exe") and
	process.thread.Ext.call_stack_summary != "ntdll.dll
| kernelbase.dll
| libcef.dll
| kernel32.dll
| ntdll.dll"