✄𐘗
text code block:
✄𐘗process where event.type == "start" and event.action == "exec" and
process.name == "unshare" and container.id like "?*" and not (
  process.parent.executable: ("/usr/bin/udevadm", "*/lib/systemd/systemd-udevd", "/usr/bin/unshare") or
  (process.args == "/usr/bin/snap" and not process.parent.name in ("zz-proxmox-boot", "java")) or
  process.parent.args like (
    "/etc/kernel/postinst.d/zz-proxmox-boot", "/opt/openssh/sbin/sshd", "/usr/sbin/sshd",
    "/snap/*", "/home/*/.local/share/JetBrains/Toolbox/*"
  ) or
 (process.args == "--propagation" and process.args == "private" and process.args like "/etc/kernel/post*.d/zz-proxmox-boot") or 
 (process.args == "--fork" and process.args == "--kill-child") or 
  process.args like ("/usr/bin/os-prober", "/usr/bin/linux-boot-prober", "/opt/SIGOS/sitedata/exec/*")
)