✄𐘗
text code block:
✄𐘗sequence by container.id, user.id with maxspan=10s
  [file where event.action == "creation" and (
     process.name in ("curl", "wget", "fetch", "ftp", "sftp", "scp", "rsync", "ld") or
     (
       process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
       process.args in (
         "curl", "/bin/curl", "/usr/bin/curl", "/usr/local/bin/curl",
         "wget", "/bin/wget", "/usr/bin/wget", "/usr/local/bin/wget",
         "fetch", "/bin/fetch", "/usr/bin/fetch", "/usr/local/bin/fetch",
         "ftp", "/bin/ftp", "/usr/bin/ftp", "/usr/local/bin/ftp",
         "sftp", "/bin/sftp", "/usr/bin/sftp", "/usr/local/bin/sftp",
         "scp", "/bin/scp", "/usr/bin/scp", "/usr/local/bin/scp",
         "rsync", "/bin/rsync", "/usr/bin/rsync", "/usr/local/bin/rsync",
         "ld", "/bin/ld", "/usr/bin/ld", "/usr/local/bin/ld"
       ) and
       /* default exclusion list to not FP on default multi-process commands */
       not process.args in (
         "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
         "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
         "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
         "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
       )
     )
   ) and file.path like (
     "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*",
     "/proc/*/fd/*", "/home/*/*", "/root/*", "/opt/*"
   )
  ] by file.name
  [process where event.type == "start" and event.action == "exec" and
   process.parent.name in ("bash", "dash", "ash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox")
  ] by process.name
  [file where event.action == "deletion" and file.path like (
     "/dev/shm/*", "/run/shm/*", "/tmp/*", "/var/tmp/*", "/run/*", "/var/run/*", "/var/www/*",
     "/proc/*/fd/*", "/home/*/*", "/root/*", "/opt/*"
    ) and not process.name in ("rm", "ld", "conftest", "link", "gcc", "getarch", "ld")
  ] by file.name