Suspicious File Rename via SMB

sequence with maxspan=3s
 [network where event.action == "connection_accepted" and destination.port == 445 and source.port >= 49152 and
  process.pid == 4 and network.type == "ipv4" and not endswith(source.address, destination.address) and
  source.ip != "127.0.0.1" and source.ip != "::1" ]
 [file where event.action == "rename" and process.pid == 4 and user.id like ("S-1-5-21*", "S-1-12-*") and
  file.extension != null and file.Ext.entropy >= 6 and file.path : "C:\\Users\\*" and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.lnk", "*.txt") and
  not file.extension in~ ("jpg", "bmp", "png", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "lnk", "txt")]
 [file where event.action == "rename" and process.pid == 4 and user.id like ("S-1-5-21*", "S-1-12-*") and
  file.extension != null and file.Ext.entropy >= 6 and file.path : "C:\\Users\\*" and
  file.Ext.original.name : ("*.jpg", "*.bmp", "*.png", "*.pdf", "*.doc", "*.docx", "*.xls", "*.xlsx", "*.ppt", "*.pptx", "*.lnk", "*.txt") and
  not file.extension in~ ("jpg", "bmp", "png", "pdf", "doc", "docx", "xls", "xlsx", "ppt", "pptx", "lnk", "txt")]