process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.command_line like (
    "*/run/secrets/kubernetes.io/serviceaccount*",
    "*/var/run/secrets/kubernetes.io/serviceaccount*",
    "*/secrets/kubernetes.io/serviceaccount*"
  ) or (
    process.working_directory like (
      "/run/secrets/kubernetes.io/serviceaccount",
      "/var/run/secrets/kubernetes.io/serviceaccount",
      "/secrets/kubernetes.io/serviceaccount"
    ) and
    process.args in ("ca.crt", "token", "namespace")
  )
)