✄𐘗
text code block:
✄𐘗sequence by process.entity_id with maxspan=30s
  [process where host.os.type == "macos" and event.type == "start" and process.name in ("bash", "sh", "zsh") and
    process.args like~ ("/tmp/PKInstallSandbox.*/Scripts/com.*/preinstall", 
                        "/tmp/PKInstallSandbox.*/Scripts/*/postinstall") and
    process.args like ("/Users/*", "/Volumes/*") and 
    not process.args like~ "/Users/*/Library/Caches/*"]
  [file where host.os.type == "macos" and event.action != "deletion" and process.name in ("mv", "cp") and
    (file.extension in ("py", "js", "sh", "scpt", "terminal", "tcl", "app", "pkg", "dmg", "command") or
      file.Ext.header_bytes like~ ("cffaedfe*", "cafebabe*")) and
    file.path like ("/private/etc/*", "/var/tmp/*", "/tmp/*", "/var/folders/*", "/Users/Shared/*",
                    "/Library/Graphics/*", "/Library/Containers/*", "/Users/*/Library/Containers/*", 
                    "/Users/*/Library/Services/*", "/Users/*/Library/Preferences/*", "/var/root/*",
                    "/Library/WebServer/*", "/Library/Fonts/*", "/usr/local/bin/*") and 
    not file.name == "CodeResources"]