Detect Financial Theft in Splunk

| multisearch
    [search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
     (TargetFilename="*wallet.dat*" OR TargetFilename="*\\Exodus\\*" OR TargetFilename="*\\Electrum\\*"
      OR TargetFilename="*\\Ethereum\\keystore\\*" OR TargetFilename="*MetaMask*"
      OR TargetFilename="*\\Coinbase\\*" OR TargetFilename="*\\AppData\\*\\Extensions\\*")
     NOT (Image="*\\chrome.exe" OR Image="*\\msedge.exe" OR Image="*\\firefox.exe"
          OR Image="*\\brave.exe" OR Image="*\\Exodus.exe" OR Image="*\\Electrum.exe")
     | eval alert_type="CryptoWalletFileCreate", risk_score=80
     | fields _time, host, User, Image, TargetFilename, alert_type, risk_score]
    [search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
     (CommandLine="*wallet.dat*" OR CommandLine="*keystore*" OR CommandLine="*exodus*"
      OR CommandLine="*metamask*" OR CommandLine="*.ethereum*" OR CommandLine="*seed phrase*"
      OR CommandLine="*mnemonic*" OR CommandLine="*private_key*" OR CommandLine="*crypto*wallet*")
     | eval alert_type="CryptoWalletProcessCmd", risk_score=85
     | fields _time, host, User, Image, CommandLine, ParentImage, alert_type, risk_score]
    [search index=windows sourcetype="WinEventLog:Security" EventCode=4663
     (ObjectName="*\\wallet.dat" OR ObjectName="*\\Exodus\\*" OR ObjectName="*\\Electrum\\*"
      OR ObjectName="*\\Ethereum\\keystore\\*")
     | eval alert_type="CryptoWalletObjAccess", risk_score=75
     | fields _time, host, SubjectUserName, ProcessName, ObjectName, alert_type, risk_score
     | rename SubjectUserName as User, ProcessName as Image, ObjectName as TargetFilename]
    [search index=o365 sourcetype="o365:management:activity"
     (Operation="New-InboxRule" OR Operation="Set-InboxRule" OR Operation="UpdateInboxRules")
     | spath input=Parameters output=params_str
     | search params_str IN ("*ForwardTo*", "*RedirectTo*", "*ForwardAsAttachmentTo*")
     | search params_str IN ("*invoice*", "*payment*", "*wire*", "*transfer*", "*bank*", "*cfo*", "*ceo*", "*payroll*")
     | eval alert_type="BECInboxRule", risk_score=90
     | fields _time, host, UserId, ClientIP, params_str, alert_type, risk_score
     | rename UserId as User, params_str as TargetFilename, ClientIP as Image]
| eval _time=strptime(_time, "%Y-%m-%dT%H:%M:%S")
| bin _time span=10m
| stats count as event_count, values(alert_type) as alert_types,
    max(risk_score) as max_risk, min(_time) as first_seen, max(_time) as last_seen,
    values(TargetFilename) as targets, values(Image) as processes
    by _time, host, User
| eval distinct_alert_types=mvcount(alert_types)
| eval final_risk=case(
    distinct_alert_types >= 2, "Critical",
    max_risk >= 85, "High",
    max_risk >= 70, "Medium",
    true(), "Low"
)
| where final_risk IN ("Critical", "High", "Medium")
| table _time, host, User, alert_types, event_count, final_risk, first_seen, last_seen, targets, processes
| sort - final_risk, - event_count