file where host.os.type == "linux" and event.type in ("creation", "file_create_event") and user.id == "0" and
file.path : ("/etc/ld.so.conf.d/*", "/etc/cron.d/*", "/etc/sudoers.d/*", "/etc/init.d/*", "/etc/systemd/system/*",
"/usr/lib/systemd/system/*") and not (
  (process.name : (
    "chef-client", "ruby", "pacman", "packagekitd", "python*", "platform-python", "dpkg", "yum", "apt", "dnf", "rpm",
    "systemd", "snapd", "dnf-automatic", "yum-cron", "elastic-agent", "dnfdaemon-system", "dockerd", "executor",
    "rhn_check"
    )
  ) or 
  (file.extension in ("swp", "swpx", "tmp"))
)