✄𐘗
text code block:
✄𐘗sequence by host.id with maxspan=30s
  [process where host.os.type == "linux" and event.type == "start" and
   event.action == "executed" and
   user.id != "0" and user.effective.id != "0" and
   (
     process.name like ("python*", "perl*", "ruby*", "php*", "lua*", ".*") or
     process.name in ("node", "bun", "java") or
     process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/user/*", "/var/run/user/*", "/home/*/*") or
     (
       process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh") and
       process.args in ("-c", "--command", "-ic", "-ci", "-cl", "-lc")
     )
   )
  ] by process.pid

  [process where host.os.type == "linux" and event.type == "start" and
   event.action == "executed" and
   user.effective.id == "0" and user.id != "0" and
   (
     (process.name in ("sudo", "pkexec") and
      not process.args like "-*" and
      not process.args : ("/usr/*", "/bin/*", "/sbin/*", "/opt/*")) or
     (process.name == "su" and
      not process.args in ("--command", "-c", "--shell", "-s")) or
     (process.name in ("passwd", "chsh", "newgrp") and
      not process.args in ("--shell", "-s", "--help"))
   )
  ] by process.parent.pid