✄𐘗
text code block:
✄𐘗event.category : "process" and event.type : "start" and event.action:(start or exec) and 
(
  process.name : (
    pacu or pacu.exe or cloudfox or cloudfox.exe or
    weirdaal or "enumerate-iam" or enumerate_iam or scoutsuite or pmapper or
    prowler or prowler.exe or cloudmapper or cloudsplaining or cloud_enum or
    cloudbrute or cloudbrute.exe or nimbostratus or "aws-enumerator" or "aws-enumerator.exe" or
    skyark or awsbucketdump or dsnap or aaia or
    aws_consoler or awsconsoler or redboto or cloudjack or s3scanner or s3scanner.exe or
    cloudsploit or "iam-vulnerable" or smogcloud
  ) or
  (process.name : (stratus or stratus.exe) and process.args : (detonate or warmup or revert or cleanup)) or
  (process.name : cartography and process.args : ("--aws-sync-all-profiles" or "--aws-requested-syncs")) or
  (
    process.name : (python* or pipx or uv or uvx or go or node) and
    process.command_line : (
      *cloudfox* or *enumerate_iam* or *enumerate-iam* or *weirdAAL* or *aws_consoler* or
      *-m pacu* or *pacu.py* or *aws_escalate* or *scoutsuite* or *pmapper* or
      *cloudmapper* or *cloudsplaining* or *nimbostratus* or *leonidas-framework* or
      *cloud_enum* or *halberd* or *skyark* or *awsbucketdump* or *stratus-red-team* or
      *prowler* or *cloudsploit* or *cloudbrute* or *fog-aws* or *barq*
    )
  )
) and not process.command_line : (
  *pip install* or *pip3 install* or *pipx install* or *uv pip install* or *uv tool install* or
  *go get* or *go install* or *go build* or *go test* or *npm install* or *--help* or *--version* or
  *git clone* or *pytest* or "*site-packages/pip*"
) and not process.parent.name : (dpkg or rpm or apt or yum or dnf or brew or pip or pip3)