✄𐘗
text code block:
✄𐘗sequence by process.entity_id with maxspan=15s
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    process.parent.name in ("bash", "sh", "zsh") and
    process.name in ("whoami", "ifconfig", "system_profiler", "dscl", "arch", "csrutil") and
    process.args_count == 1]
  [file where host.os.type == "macos" and event.action == "modification" and
    file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/Library/WebServer/*",
                    "/Library/Graphics/*", "/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*", "/*/.*") and
    not file.path like ("/private/tmp/*.fifo", "/private/tmp/tcl-tk*")]