✄𐘗
text code block:
✄𐘗host.os.type:linux and event.category:file and event.type:creation and (
  process.name:("cp" or "mv") or
  process.executable:(
    ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /run/user/* or /var/run/user/* or /boot/* or /sys/* or
    /lost+found/* or /proc/* or /var/mail/* or /var/www/*
  )
) and
file.path:(/run/* or /var/run/* or /dev/shm/* or /tmp/* or /var/tmp/*) and
not (
  file.path:(
    /var/tmp/dracut.* or /var/tmp/mkinitramfs_* or /tmp/.*-00000000.so or /run/udev/rules.d/* or
    /tmp/new_root/* or /tmp/newroot/* or /run/user/*/.bubblewrap/newroot/* or /tmp/tmp.*/docker-scout_* or
    /var/tmp/portage/* or /tmp/yarn--* or /run/k3s/containerd/* or /var/tmp/pamac-build-* or
    /tmp/mkinitcpio* or /run/user/*/netns/netns-* or /tmp/apt-key* or /tmp/tmp.*/pubring.orig.gpg or
    /tmp/CVU_19_* or /tmp/ut-backup-files.* or /tmp/tmp.*/terraform/*
  ) or
  file.extension:("json" or "txt") or
  process.executable:(
    /tmp/par-* or /tmp/snap.rootfs_* or /tmp/CVU_*/exectask or /tmp/.mount_*/usr/bin/QGroundControl or
    ./snap/snapd/*/usr/lib/snapd/snap-update-ns or "./usr/lib/snapd/snap-update-ns" or
    "/tmp/newroot/snap/snapd/current/usr/bin/snap" or /tmp/newroot/snap/snapd/*/usr/lib/snapd/snap-confine or
    "./usr/bin/podman" or "/tmp/newroot/usr/lib/systemd/systemd"
  )
)