✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") or
  (
    process.parent.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/root/*", "/home/*") or
    process.parent.name like (".*", "*.sh")
  )
) and
(
  (
    process.working_directory like ("/etc/kubernetes", "/root/.kube", "/home/*/.kube") and
    process.args in ("kubeconfig", "admin.conf", "super-admin.conf", "kubelet.conf", "controller-manager.conf", "scheduler.conf")
  ) or
  process.args like (
    "/etc/kubernetes/admin.conf",
    "/etc/kubernetes/super-admin.conf",
    "/etc/kubernetes/kubelet.conf",
    "/etc/kubernetes/controller-manager.conf",
    "/etc/kubernetes/scheduler.conf",
    "/home/*/.kube/config",
    "/root/.kube/config",
    "/var/lib/*/kubeconfig"
  )
) and not (
  process.name in ("stat", "md5sum", "dirname") or
  (process.name like "python*" and process.args == "/usr/bin/yq" and process.parent.name == "fish") or
  process.executable in (
    "/usr/bin/file", "/usr/bin/readlink", "/bin/readlink", "/bin/file", "/tmp/newroot/bin/readlink",
    "/tmp/newroot/bin/file", "/usr/local/bin/helm"
  )
)