Suspicious Shortcut Modification

sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and process.hash.sha256 != null and
 (
  process.name : ("rundll32.exe", "regsvr32.exe", "powershell.exe", "wscript.exe", "curl.exe", "certutil.exe", "cmd.exe") or
  ((process.Ext.relative_file_creation_time <= 300 or process.Ext.relative_file_name_modify_time <= 300) and
     not process.code_signature.status : "trusted")
 ) and 
 not process.executable : 
           ("?:\\Program Files\\*.exe", 
            "?:\\Program Files (x86)\\*.exe",
            "?:\\Config.Msi\\*.rbf",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\*\\Installer\\setup.exe",
            "?:\\Windows\\servicing\\TrustedInstaller.exe",
            "?:\\Windows\\SystemApps\\*.exe",
            "?:\\Windows\\System32\\DeviceEnroller.exe",
            "?:\\Windows\\CCM\\UpdateTrustedSites.exe",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\Application\\msedge.exe",
            "C:\\Program Files (x86)\\Lizard\\GPProcessing\\RunScript.exe") and
  not (process.code_signature.subject_name :
          ("Google*",
           "Notepad*",
           "Slack*",
           "Mozilla*",
           "Zoom*",
           "Discord*",
           "Citrix Systems, Inc.") and
       process.code_signature.trusted == true) and
  not (process.executable : "?:\\Users\\*\\Microsoft\\EdgeUpdate\\Install\\*\\setup.exe" and
       process.code_signature.subject_name : "Microsoft*" and process.code_signature.trusted == true) and

  not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe" and
        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation") and 
  not (process.name : ("wscript.exe", "cscript.exe", "cmd.exe") and process.command_line : "*\\\\*\\SysVol\\*") and 
  not (process.name : "cmd.exe" and process.args : "*.bat ") and
  not (process.name : "powershell.exe" and process.args : ("C:\\Windows\\Managetaskbar\\taskband.ps1", "C:\\Program Files\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSystemTools\\*_AddOfficeIconsToDesktop.ps1")) and
  /* unsigned Notepad++ installer */
  not process.pe.imphash in ("9dda1a1d1f8a1d13ae0297b47046b26e", "7fa974366048f9c551ef45714595665e") and
  not (process.name : "rundll32.exe" and process.args :"shell32.dll,SHCreateLocalServerRunDll" and process.parent.name : "svchost.exe") and
  not process.hash.sha256 in ("7a8998de0f56fb3303d071d6d87bd9c1b4472bc84bba5090993936a8bc819771", "bd68b94f58ad350ccb89f6b9e2b2f473731239fb0aa1902c21cb83e117d66b2e")
 ]
[file where event.action == "overwrite" and file.extension : "lnk" and process.pid != 4 and 
 process.executable : "?:\\*" and
  file.path :
     ("?:\\Users\\*\\Desktop\\*.lnk",
      "?:\\Users\\*\\Microsoft\\Internet Explorer\\Quick Launch\\*.lnk",
      "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk",
      "?:\\Users\\*\\Start Menu\\Programs\\Startup\\*.lnk",
      "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.lnk") and
  file.Ext.header_bytes : "4c000000*" and
  file.name : ("Google Chrome.lnk", "Outlook.lnk", "Microsoft Outlook.lnk","Microsoft Edge.lnk",
               "Mozilla Thunderbird.lnk", "Firefox.lnk", "Word.lnk", "Excel.lnk", "Notepad++.lnk",
               "File Explorer.lnk", "PowerPoint.lnk", "Zoom.lnk", "slack.lnk", "Discord.lnk") and
  not (file.name == "Notepad++.lnk" and process.code_signature.subject_name == "Notepad++")]