✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.name in ("zip", "tar", "gzip", "hdiutil", "7z", "rar", "7zip", "p7zip") or
  (
    /* account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg */
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox") and
    process.args in (
      "zip", "/bin/zip", "/usr/bin/zip", "/usr/local/bin/zip",
      "tar", "/bin/tar", "/usr/bin/tar", "/usr/local/bin/tar",
      "gzip", "/bin/gzip", "/usr/bin/gzip", "/usr/local/bin/gzip",
      "hdiutil", "/bin/hdiutil", "/usr/bin/hdiutil", "/usr/local/bin/hdiutil",
      "7z", "/bin/7z", "/usr/bin/7z", "/usr/local/bin/7z",
      "rar", "/bin/rar", "/usr/bin/rar", "/usr/local/bin/rar",
      "7zip", "/bin/7zip", "/usr/bin/7zip", "/usr/local/bin/7zip",
      "p7zip", "/bin/p7zip", "/usr/bin/p7zip", "/usr/local/bin/p7zip"
    ) and 
    /* default exclusion list to not FP on default multi-process commands */
    not process.args in (
      "which", "/bin/which", "/usr/bin/which", "/usr/local/bin/which",
      "man", "/bin/man", "/usr/bin/man", "/usr/local/bin/man",
      "chmod", "/bin/chmod", "/usr/bin/chmod", "/usr/local/bin/chmod",
      "chown", "/bin/chown", "/usr/bin/chown", "/usr/local/bin/chown"
    )
  )
) and
process.args like~ (
  "*/root/.ssh/*", "*/home/*/.ssh/*", "*/root/.bash_history*", "*/etc/hosts*", "*/root/.aws/*", "*/home/*/.aws/*",
  "*/root/.docker/*", "*/home/*/.docker/*", "*/etc/group*", "*/etc/passwd*", "*/etc/shadow*", "*/etc/gshadow*",
  "*/.azure/*", "*/var/run/secrets/azure/*", "*/.config/gcloud/*", "*application_default_credentials.json*",
  "*type: service_account*", "*client_email*", "*private_key_id*", "*private_key*", "*/var/run/secrets/google/*",
  "*GOOGLE_APPLICATION_CREDENTIALS*", "*AZURE_CLIENT_ID*", "*AZURE_TENANT_ID*", "*AZURE_CLIENT_SECRET*",
  "*AZURE_FEDERATED_TOKEN_FILE*", "*IDENTITY_ENDPOINT*", "*IDENTITY_HEADER*", "*MSI_ENDPOINT*", "*MSI_SECRET*"
) and container.id like "*"