✄𐘗
text code block:
✄𐘗sequence by host.id with maxspan=5s
 [network where event.action == "connection_accepted" and network.direction == "ingress" and

  process.name : "java" and
  destination.port < 49152  and source.port >= 32768] by process.pid
 [process where event.type == "start" and

  /* Suspicious JAVA child process */
  process.parent.name : "java" and
  process.name : (
    "sh", "bash", "dash", "ksh", "tcsh", "zsh", "ash",  "mksh", "busybox",
    "curl", "wget", "perl*", "python*", "ruby*", "php*", "lua*", "socat",
    "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
    "nc.traditional", "nohup", "setsid", "disown", "hostname", "whoami", "id"
  ) and
    not process.command_line like~ (
      "bash -c ulimit -u",
      "bash /opt/flutter/bin/flutter*",
      "bash -c echo $$",
      "/bin/bash /opt/python3/bin/jira*",
      "/bin/sh -c env LC_ALL=C /usr/sbin/lpc status*"
    )] by process.parent.pid