Detect Credentials from Web Browsers in Elastic Security

any where (
  (
    event.category == "file" and
    event.type in ("creation", "change") and
    file.name in ("Login Data", "logins.json", "key3.db", "key4.db", "signons.sqlite", "Web Data", "Cookies", "Local State") and
    (
      file.path like~ "*Google\\Chrome\\User Data*" or
      file.path like~ "*Mozilla\\Firefox\\Profiles*" or
      file.path like~ "*Microsoft\\Edge\\User Data*" or
      file.path like~ "*BraveSoftware\\Brave-Browser*" or
      file.path like~ "*Opera Software*"
    ) and
    not process.name in~ ("chrome.exe", "firefox.exe", "msedge.exe", "brave.exe", "opera.exe", "iexplore.exe", "SearchProtocolHost.exe", "SearchIndexer.exe")
  ) or
  (
    event.category == "process" and
    event.type == "start" and
    (
      process.name like~ "*browserpassview*" or
      process.name like~ "*webbrowserpassview*" or
      process.name like~ "*chromepass*" or
      process.name like~ "*mimikittenz*" or
      process.name like~ "*browserghost*" or
      process.name like~ "*sharpchromium*" or
      process.name like~ "*hackbrowserdata*" or
      process.name like~ "*lazagne*" or
      (
        process.command_line like~ "*Login Data*" and
        not process.name in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe")
      ) or
      (
        process.command_line like~ "*logins.json*" and
        not process.name in~ ("firefox.exe")
      ) or
      (
        process.command_line like~ "*key4.db*" and
        not process.name in~ ("firefox.exe")
      ) or
      process.command_line like~ "*CryptUnprotectData*" or
      process.command_line like~ "*SELECT*FROM logins*" or
      process.command_line like~ "*SELECT*password_value*"
    )
  )
)