Unusual File Written or Modified in Startup Folder

file where event.action != "deletion" and
  process.pid != 4 and process.executable != null and
  file.name != null and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
  file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  (
   /* file extensions rarely written to Startup folder by legit installers */
   file.extension : ("exe", "com", "scr", "dll", "hta", "ps1", "cmd", "url", "wsh", "wsf", "vbe", "jse", "sick", "png", "jpg", "manifest", "ahk", "jar") or

   /* suspicious file names */
   length(file.name) <= 6 or
   file.name :
        ("*Microsoft*",
         "*fuck*",
         "*:*",
         "*.*.",
         "*update*",
         "*windows*",
         "*setup*",
         "*googl*",
         "*adobe*",
         "*chrome*")
   ) and
   not process.executable :
               ("?:\\Windows\\SysWOW64\\msiexec.exe",
                "?:\\Windows\\system32\\msiexec.exe",
                "?:\\Windows\\explorer.exe",
                "?:\\Windows\\System32\\svchost.exe",
                "?:\\Windows\\System32\\dllhost.exe",
                "?:\\Windows\\System32\\xcopy.exe",
                "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*.exe",
                "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*.exe",
                "?:\\Program Files\\Windows Defender Advanced Threat Protection\\*.exe",
                "\\Device\\Mup\\*\\SysVol\\*") and
    not (process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and not process.name : "javaw.exe") and
    not (process.name : "cmd.exe" and file.extension : "cmd") and
    not (process.code_signature.subject_name :
                 ("Intercontinental Exchange, Inc.", "Chocolatey Software, Inc.", "ONELAUNCH TECHNOLOGIES INC.", 
                  "Notepad++", "Ghisler Software GmbH", "Western Union Holdings Inc.", "AnyDesk Software GmbH", "Learnpulse SAS") and
         process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*")) and
    not (process.executable : "?:\\Windows\\System32\\notepad.exe" and file.extension : ("bat", "cmd")) and
    not (process.executable : "C:\\Windows\\SysWOW64\\cscript.exe" and file.name : "WUPOSStartup.exe") and
    not (process.name : "cmd.exe" and file.name : "MonitorES.exe")