✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name in ("chmod", "chown") and
process.args like~ (
  "/bin/*", "/usr/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*",
  "/lib/*", "/usr/lib/*", "/lib64/*", "/usr/lib64/*"
) and
process.args in ("4755", "755", "000", "777", "444", "-x", "+x") and not (
  process.args in ("/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod") or
  process.parent.executable like~ ("/tmp/newroot/*", "/var/lib/dpkg/info/*") or
  process.parent.name in ("udevadm", "systemd", "entrypoint", "sudo", "dart") or
  process.parent.command_line == "runc init" or
  process.parent.args like "/var/tmp/rpm-tmp.*"
)