✄𐘗
text code block:
✄𐘗event.category:file and host.os.type:linux and event.action:(creation or rename) and (
  process.name: (
    "nginx" or "apache2" or "httpd" or "caddy" or "lighttpd" or "httpd.worker" or "httpd-worker" or "httpd-prefork" or
    "php-cgi" or "php-fcgi" or "php-cgi.cagefs" or "frankenphp" or "lshttpd" or "litespeed" or "openlitespeed" or
    "fcgiwrap" or "uwsgi" or "daphne" or "uvicorn" or "hypercorn" or "granian" or "waitress-serve" or "flask" or
    "puma" or "unicorn" or "unicorn_rails" or "thin" or "rackup" or "mongrel_rails" or "starman" or "plackup" or
    "twiggy" or "hypnotoad" or "starlet" or "unitd" or "unitd-debug" or php-fpm* or lsphp* or gunicorn* or
    "nginx3" or "apache" or *.cgi or *.fcgi
  ) or
  (process.name: "java" and file.extension: ("jsp" or "jspx" or "jspf" or "tag" or "tagx" or "war" or "ear")) or
  (process.name: ("node" or "nodejs") and file.extension: ("js" or "mjs" or "cjs" or "ts" or "mts" or "cts")) or
  (process.name: "dotnet" and file.extension: ("cshtml" or "razor")) or
  (process.name: (mono* or xsp* or mod-mono-server* or fastcgi-mono-server*) and file.extension: ("asp" or "aspx" or "ashx" or "asmx" or "ascx" or "cshtml")) or
  (process.name: python* and file.extension: ("wsgi" or "cgi" or "fcgi")) or
  (process.name: ruby* and file.extension: ("erb" or "ru")) or
  (process.name: perl* and file.extension: ("cgi" or "fcgi" or "psgi")) or
  (process.name: lua* and file.extension: ("lua" or "luac"))
) and
file.path:(
  /home/*/* or /var/www/* or /srv/www/* or /srv/http/* or /usr/share/nginx/* or /opt/zimbra/jetty* or
  /usr/share/caddy/* or /usr/local/lsws/* or /opt/bitnami/* or */sites/*/files/* or /opt/easyengine/* or
  */wp-content/* or */httpdocs/* or */httpsdocs/* or */htdocs/* or */wwwroot/* or */webroot/* or */cgi-bin/* or
  */upload/* or */uploads/* or */images/* or */media/* or */userfiles/* or */attachments/* or
  /usr/share/webapps/* or /usr/share/zabbix/* or /usr/share/phpmyadmin/* or /usr/share/phpMyAdmin/* or
  /var/lib/roundcube/* or /usr/share/cacti/* or /usr/share/nagios* or /var/lib/tomcat* or /usr/share/tomcat* or
  /usr/local/tomcat/* or /opt/tomcat* or /var/lib/jetty* or /usr/share/jetty* or
  /usr/local/cpanel/* or /usr/local/psa* or /opt/psa/admin/* or /usr/share/webmin/* or
  /usr/libexec/webmin/* or /usr/local/nginx/* or /usr/local/apache* or /usr/sap/* or /opt/rh/* or
  */public_html/* or */private_html/* or */public/* or */private/* or */deployments/* or */autodeploy/* or
  */dropins/* or */installedApps/* or /srv/caddy/* or /usr/local/openresty/* or */fileadmin/* or */custom_apps/* or
  */vhost* or /opt/apache-tomcat* or /opt/jetty* or /usr/local/jetty* or */wildfly*/* or */jboss*/* or */glassfish/* or
  */user_projects/domains/* or */resin*/webapps/* or */installedApps/*
) and
not (
  file.path:*/storage/framework/sessions/* or
  (
    process.name:php-fpm* and
    file.path:(
      /mnt/WEB/*/public_html/tmp/templates/frontend/*.php or
      /mnt/WEB/*/public_html/wp-content/languages/*.json
    )
  ) or
  (process.name:node and (user.id >= 1000 or user.id:0)) or
  (
    (
      file.path:(
        */.npm/* or */_cache/* or */_inventories/* or */_sessions/* or
        */cache/tcpdf/* or */cachestore_file/* or */files_trashbin/* or
        */localcache/* or */node_modules/* or */proxy_temp/* or
        */sessions/sess_* or */storage/framework/cache/* or
        */temp-write-test-* or */thumbnails/* or
        */uploads/web-file-upload-*
      ) or
      file.extension:(
        BMP or GIF or ICO or JPEG or JPG or PDF or PNG or SVG or TIFF or
        WEBP or avi or bmp or cache or flv or gif or ico or jpeg or jpg or
        lock or mkv or mov or mp3 or mp4 or ogg or part or pdf or png or
        svg or temp or tiff or tmp or tmpfsfile or wav or webp or wmv
      )
    ) and
    not file.name:(*.asp* or *.cgi* or *.jsp* or *.php* or *.phtml*)
  )
)