host.os.type:linux and event.category:process and event.type:start and event.action:exec and
process.parent.name:(* and not (
  awk or bwrap or cylancesvc or dbus-run-session or java or julia or make or matlab_helper or ninja or noproc_sandbox or
  nxrunner or nxserver or perl or rear or sapcontrol or setsid or spoold or sshd or steam or su or sudo or titanagent or
  vls_agent or zabbix_agentd
)) and
process.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
process.args:-c and process.command_line:(*LD_LIBRARY_PATH=* or *LD_PRELOAD=*)