event.category:process and host.os.type:linux and event.type:start and event.action:exec and user.name:(
   daemon or bin or sys or sync or games or man or mail or news or uucp or proxy or backup or list or irc
   or gnats or _apt or Debian-exim or systemd-timesync or messagebus or uuidd or _chrony or sshd or
   gamer or shutdown or halt or dbus or polkitd or rtkit or pipewire or tcpdump or clevis or
   libstoreagemgmt or geoclue or tss or sssd or gnome-initial-setup or pesign or dnsmasq or chrony 
) and process.interactive:true and process.parent.executable:* and not (
  process.parent.name:(
    apt-key or apt-config or gpgv or gpgconf or man-db.postinst or sendmail or rpm or nullmailer-inject
  ) or
  process.args:(/etc/apt/trusted.gpg.d/* or /tmp/apt-key-gpg*) or
  process.name:(awk or apt-config or dpkg or grep or gpgv or sed) or
  (user.name:daemon and process.name:at)
)