✄𐘗
text code block:
✄𐘗sequence by process.entity_id with maxspan=30s
  [file where host.os.type == "macos" and event.action == "open" and 
    not file.name in~ ("System.keychain", "login.keychain-db", "preferences.plist", "com.apple.TimeMachine.plist")]
  [file where host.os.type == "macos" and event.action == "modification" and 
    file.extension in ("zip", "gzip", "gz") and
    file.path like~ ("/Users/Shared/*", "/Library/WebServer/*", "/Users/*/Library/WebServer/*",
                     "/Library/Graphics/*", "/Users/*/Library/Graphics/*", "/Library/Fonts/*",
                     "/Users/*/Library/Fonts/*", "/private/var/root/Library/HTTPStorages/*",
                     "/tmp/*", "/var/tmp/*", "/private/tmp/*") and
    not file.path like~ ("/Library/Logs/CrashReporter/*", "/private/tmp/publish.*")]