Suspicious Okta Agent Cross Process Activity

api where
 process.Ext.api.behaviors : "cross-process" and process.Ext.api.name : ("WriteProcessMemory", "VirtualProtectEx", "ReadProcessMemory") and
 process.Ext.api.summary : ("*OktaVerify.exe*", "*OktaAgentService.exe*") and not process.Ext.api.behaviors : "parent-child" and
 process.Ext.api.metadata.target_address_name : "?*" and
 not process.Ext.api.metadata.target_address_name in ("PEB", "PEB32", "ProcessStartupInfo") and
 not process.thread.Ext.call_stack_final_user_module.name : ("Kernel", "Unknown", "Undetermined") and
 not (process.code_signature.status : "trusted" and startswith~(process.thread.Ext.call_stack_final_user_module.name, process.name)) and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "?:\\windows\\sys*\\kernelbase.dll!CreateProcess*") and
 not process.thread.Ext.call_stack_final_user_module.path :
                              ("?:\\Program Files\\*.dll",
                               "?:\\Program Files (x86)\\*.dll",
                               "\\Program Files\\*.dll",
                               "\\Program Files (x86)\\*.dll",
                               "\\windows\\system32\\*.dll",
                               "\\windows\\syswow64\\*.dll",
                               "?:\\windows\\system32\\*.dll",
                               "?:\\Windows\\SysWOW64\\*.dll",
                               "?:\\Windows\\FireEye\\AppMonitorDll*.dll*",
                               "?:\\Windows\\apppatch\\AppPatch*\\exploitblocker.dll*")