✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
process.parent.name in (
  "applypatch-msg", "commit-msg", "fsmonitor-watchman", "post-update", "post-checkout", "post-commit",
  "pre-applypatch", "pre-commit", "pre-merge-commit", "prepare-commit-msg", "pre-push", "pre-rebase", "pre-receive",
  "push-to-checkout", "update", "post-receive", "pre-auto-gc", "post-rewrite", "sendemail-validate", "p4-pre-submit",
  "post-index-change", "post-merge", "post-applypatch"
) and
(
  process.name in ("nohup", "setsid", "disown", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
  process.name like ("php*", "perl*", "ruby*", "lua*") or
  process.executable like (
    "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/etc/update-motd.d/*",
    "/run/*", "/srv/*", "/tmp/*", "/var/tmp/*", "/var/log/*"
  )
) and
not process.name in ("git", "dirname")