✄𐘗
text code block:
✄𐘗sequence by process.parent.entity_id with maxspan=3s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.executable != null and
   process.name in ("base64", "base64plain", "base64url", "base64mime", "base64pem", "base32", "base16") and
   // Only including potentially suspicious locations
   process.args like~ ("-d*", "--d*") and process.working_directory like (
     "/tmp/*", "/var/tmp*", "/dev/shm/*", "/var/www/*", "/home/*", "/root/*"
   ) and not (
     process.parent.executable in (
       "/usr/share/ec2-instance-connect/eic_curl_authorized_keys", "/etc/cron.daily/vivaldi",
       "/etc/cron.daily/opera-browser"
     ) or
     process.working_directory like (
       "/opt/microsoft/omsagent/plugin", "/opt/rapid7/ir_agent/*", "/tmp/newroot/*"
      ) or
      (process.parent.name == "zsh" and process.parent.command_line like "*extendedglob*")
   )]
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.executable != null and
   process.name in ("base64", "base64plain", "base64url", "base64mime", "base64pem", "base32", "base16") and
   process.args like~ ("-d*", "--d*")]