✄𐘗
text code block:
✄𐘗file where host.os.type == "linux" and event.action in ("rename", "creation") and
file.Ext.header_bytes like "7f454c46*" and (
  process.name in (
    "curl", "wget", "ftp", "tftp", "scp", "rsync", "busybox", "timeout", "env", "cp", "mv",
    "install", "dd", "tee", "touch", "tar", "gzip", "gunzip", "bzip2", "bunzip2", "xz",
    "unxz", "zip", "unzip", "7z", "bun"
  ) or
  process.name like (".*", "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*") or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "*/www/html/*",
    "/lost+found/*", "/proc/*", "/var/mail/*", "/var/www/*", "/mnt/*", "/media/*", "*/wp-content/*",
    "*/wp-includes/*", "*/wp-admin/*", "?memfd:*", "memfd:*"
  )
) and
file.path like (
  "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/var/mail/*",
  "*/www/html/*", "*/wp-content/*", "*/wp-includes/*", "*/wp-admin/*"
)