✄𐘗
text code block:
✄𐘗sequence by host.id, process.parent.entity_id, process.working_directory with maxspan=1s
  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name in ("curl", "wget") and
  (
    /* IP address and path */
    process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?\\/[^ ]+.*" or
    /* URL and path */
    process.command_line regex ".*[A-Za-z0-9][A-Za-z0-9\\-]*(\\.[A-Za-z0-9][A-Za-z0-9\\-]*)+(:[0-9]{1,5})?\\/[^ ]+.*"
  ) and
  process.args_count <= 3 and (
    process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "node", "deno", "ash", "mksh", "pwsh") or
    process.parent.name like (".*", "python*", "perl*", "ruby*", "lua*", "php*") or
    process.parent.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*", "/dev/fd/*", "?memfd:*", "memfd:*"
    )
  ) and
  not (
    process.args in ("-h", "--help", "-V", "--version", "--output", "-O") or
    process.args like ("--output*", "-o*", "--remote-name*") or
    process.command_line like ("*127.0.0.1*", "*localhost*", "*artifacts.elastic.co*", "*ela.st*", "*elastic.co*")
  )]
  [process where host.os.type == "linux" and event.type == "end" and event.action == "end" and
   process.name like (
     "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish",
     "python*", "perl*", "ruby*", "lua*", "php*", "node"
   ) and process.args_count == 1 and
   process.args like (
    "-bash", "-dash", "-sh", "-tcsh", "-csh", "-zsh", "-ksh", "-fish", "-ash", "-mksh", "-pwsh",
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "ash", "mksh", "pwsh",
    "/bin/bash", "/bin/dash", "/bin/sh", "/bin/tcsh",
    "/bin/zsh", "/bin/ksh", "/bin/fish",
    "/bin/csh", "/bin/ash", "/bin/mksh", "/bin/pwsh",
    "/usr/bin/bash", "/usr/bin/dash", "/usr/bin/sh", "/usr/bin/tcsh",
    "/usr/bin/csh", "/usr/bin/zsh", "/usr/bin/ksh", "/usr/bin/fish",
    "/usr/bin/ash", "/usr/bin/mksh", "/usr/bin/pwsh",
    "/usr/local/bin/bash", "/usr/local/bin/dash", "/usr/local/bin/sh", "/usr/local/bin/tcsh",
    "/usr/local/bin/csh", "/usr/local/bin/zsh", "/usr/local/bin/ksh", "/usr/local/bin/fish",
    "/usr/local/bin/ash", "/usr/local/bin/mksh", "/usr/local/bin/pwsh",
    "python*", "/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*",
    "perl*", "/bin/perl*", "/usr/bin/perl*", "/usr/local/bin/perl*",
    "ruby*", "/bin/ruby*", "/usr/bin/ruby*", "/usr/local/bin/ruby*",
    "lua*", "/bin/lua*", "/usr/bin/lua*", "/usr/local/bin/lua*",
    "php*", "/bin/php*", "/usr/bin/php*", "/usr/local/bin/php*",
    "node", "/bin/node", "/usr/bin/node", "/usr/local/bin/node",
    "/dev/fd/*", "?memfd:*", "memfd:*"
  )
  ]