Web Browser Credential Access via Unsigned Process

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and process.hash.sha256 != null and
   (
    (process.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not process.executable : "C:\\*") or

    (process.Ext.relative_file_creation_time <= 500 and
     (process.code_signature.trusted == false or process.code_signature.exists == false) and
     not process.code_signature.status : "errorCode_endpoint*" and
     not (process.code_signature.subject_name == "Rapid7 LLC" and process.code_signature.status == "errorBadDigest"))
    ) and
    not (process.code_signature.subject_name == "Guardicore Ltd" and process.code_signature.status == "errorExpired") and
    not process.hash.sha256 : ("589c5f680eefb085a3c67c8115febbfb134dcd61e43acda83d8a2cc9c4eee035",
                               "67435999749d9e6908a4029321c0c6f9e915135e98e01a7e499a1c55a960bc68",
                               "2ef4b2d23912e15a1b0a47e17e249a909df5d973381c93741a6adbf119182e3d",
                               "6d167aee7013d61b0832937773cd71d77493a05d6ffb1849bdfb1477622e54c2",
                               "8ab494be664d7bb9a7e0dda2bc4fc6592ab26f6bb5d44b6b71b80297a532a517",
                               "eeae738673b6d694c0669fb8cd4c498b7ec6af2239d0ce3e2e6370fe75c2a771",
                               "1ea6c21fb667401513fc8c2106523510f77647a271be4f9cc1abc5b06d0e3eb5",
                               "5094013ae4283c70eeea7e2b1b4f2c084439ea8cc538473273586cf80dd79caf",
                               "84618d4ac2894c5febaf545f24285fe75cd8b4e166d5bde923661ca0d0fb7c4c")
    ]
  [file where event.type == "access" and
    /* domain user RID */
    user.id : ("S-1-5-21*", "S-1-12-*") and
    not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
    (
     file.name : ("logins.json", "cert?.db", "key?.db", "signons.sqlite", "cookies.sqlite") or 
     file.path : 
           ("?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Local State", 
            "?:\\users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", 
            "?:\\Users\\*\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data")
     ) 
     and not (process.name : "certutil.exe" and file.name : ("key?.db", "cert?.db"))
    ]