✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "start") and
process.name == "busybox" and (
  process.args in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
  process.command_line like (
    "*nc *", "*netcat*", "*openssl*", "*telnet*", "*exec*", "*import*pty*spawn*", "*import*subprocess*call*", "*socket*",
    "*system*", "*io.popen*", "*os.execute*", "*fsockopen*", "*/inet/tcp/*", "*/dev/tcp/*", "*/dev/udp/*", "*nohup*",
    "*setsid*", "*/dev/shm/*", "*ld-linux*.so*", "*/tmp/*", "*/var/tmp/*", "*rm*-rf*"
  )
) and (
  process.parent.executable like (
      "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/run/*", "/var/run/*", "/boot/*", "/sys/*", "/lost+found/*",
      "/proc/*", "/var/mail/*", "/var/www/*", "/home/*", "/root/*" 
    ) or
    process.parent.name like ".*"
) and not (
  process.parent.command_line in ("runc init", "/usr/local/bin/runc init") or
  process.parent.executable == "./runc" or
  process.parent.executable like ("/run/containerd/io.containerd.runtime.v2.task/k8s.io/*/bin/php", "/tmp/go-build*.test") or
  process.command_line == "sh -c echo EXEC" or
  process.parent.name in ("ninja_test", "ocamlrun", "ocamlopt.opt", "make", "process-wrapper")
)