file where host.os.type == "linux" and event.action in ("creation", "file_create_event") and
  process.name : "kworker*" and not (
    (process.name : "kworker*kcryptd*") or
    (file.path : (
      "/var/log/*", "/var/crash/*", "/var/run/*", "/var/lib/systemd/coredump/*", "/var/spool/*",
      "/var/lib/nfs/nfsdcltrack/main.sqlite-journal", "/proc/*/cwd/core.*", "/var/run/apport.lock",
      "/var/spool/abrt/ccpp-*", "/var/lib/dynatrace/oneagent/*", "/var/lib/nfs*", "/run/user/*/.bubblewrap/*",
      "/etc/localtime/*", "/proc/*/cwd/core.*"
      )
    )
  )