✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in (
      "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "mongrel_rails", "gunicorn",
      "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
      "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel", "php-cgi",
      "php-fcgi", "php-cgi.cagefs", "catalina.sh", "hiawatha", "lswsctrl"
  ) or
  process.parent.name like "php-fpm*" or
  user.name in ("apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9") or
  user.id in ("33", "498", "48") or
  (process.parent.name == "java" and process.parent.working_directory like "/u0?/*") or
  process.parent.working_directory like "/var/www/*"
) and (
  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox")) or
  (process.args in (
    "bash", "/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash",
    "dash", "/bin/dash", "/usr/bin/dash", "/usr/local/bin/dash",
    "sh", "/bin/sh", "/usr/bin/sh", "/usr/local/bin/sh",
    "tcsh", "/bin/tcsh", "/usr/bin/tcsh", "/usr/local/bin/tcsh",
    "csh", "/bin/csh", "/usr/bin/csh", "/usr/local/bin/csh",
    "zsh", "/bin/zsh", "/usr/bin/zsh", "/usr/local/bin/zsh",
    "ksh", "/bin/ksh", "/usr/bin/ksh", "/usr/local/bin/ksh",
    "fish", "/bin/fish", "/usr/bin/fish", "/usr/local/bin/fish",
    "busybox", "/bin/busybox", "/usr/bin/busybox", "/usr/local/bin/busybox"
  ))
) and process.args == "-c" and container.id like "?*"