event.category:process and event.type:("start" or "process_started") and process.parent.name:"java" and process.name:(
  bash or dash or sh or tcsh or csh or zsh or ksh or fish or python* or php* or perl or ruby or lua* or openssl or
  nc or netcat or ncat or telnet or awk or socat or wget or curl
) and process.args :(
  whoami or id or uname or cat or hostname or ip or curl or wget or pwd or ls or cd or python* or php* or perl or
  ruby or lua* or openssl or nc or netcat or ncat or telnet or awk or socat
)