✄𐘗
text code block:
✄𐘗sequence by host.id, process.entity_id with maxspan=5s
  [network where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
  process.executable like (
    "/boot/*", "/dev/shm/*", "/tmp/*", "/var/tmp/*", "/var/log/*", "/var/run/user/*", "/run/user/*"
  ) and
  not (
    destination.ip == null or
    destination.ip == "0.0.0.0" or 
    cidrmatch(
      destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
      "192.0.0.0/24", "192.0.0.0/29","192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32",
      "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24",
      "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24",
      "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10",
      "FF00::/8", "FC00::/7"
    )
  )]
  [file where host.os.type == "linux" and event.type == "creation" and process.executable like (
    "/boot/*", "/dev/shm/*", "/tmp/*", "/var/tmp/*", "/var/log/*", "/boot/*", "/var/run/user/*", "/run/user/*"
  ) and
  not (
    file.name like "tmp*" or file.extension in ("sqlite-journal", "db-journal", "lockfile", "tmp") or
    file.path like (
      "/loki/wal/*", "/dev/shm/.org.chromium.Chromium.*", "/opt/rapid7/nexpose/*",
      "/usr/local/ltechagent*", "/var/lib/cloudendure/agent_keystore_temp", "/var/cache/yum/*",
      "/run/aws-node/ipam.json.tmp*", "/run/systemd/journal/streams/.*"
    ) or
    (process.executable == "/tmp/terraform" and file.path like "/tmp/terraform-provider*") or 
    process.name in ("podman", "minikube", "logrotate", "java", "aws-k8s-agent", "grafana", "postman") or
    process.executable : (
      "/etc/cron.daily/logrotate", "/etc/update-motd.d/50-motd-news", "/etc/cron.hourly/0yum-hourly.cron",
      "/etc/cron.hourly/BitdefenderRedline", "/tmp/token_handler", "/tmp/.sentry-cli*.exe", 
      "/etc/cron.daily/0yum-daily.cron", "/etc/init.d/fortiedr"
    )
  )]