✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  (process.name == "kmod" and process.args == "insmod" and process.args like~ "*.ko*") or
  (process.name == "kmod" and process.args == "modprobe" and not process.args in ("-r", "--remove")) or
  (process.name == "insmod" and process.args like~ "*.ko*") or
  (process.name == "modprobe" and not process.args in ("-r", "--remove"))
) and (
  process.working_directory like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/home/*/*", "/root/*",
    "/var/www/*", "/boot/*", "/srv/*", "/mnt/*"
  ) or
  process.parent.working_directory like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/home/*/*", "/root/*",
    "/var/www/*", "/boot/*", "/srv/*", "/mnt/*"
  ) or
  process.args like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/run/*", "/var/run/*", "/home/*/*", "/root/*",
    "/var/www/*", "/boot/*", "/srv/*", "/mnt/*", "./*"
  )
) and
not (
  process.parent.executable == "/usr/bin/podman" or
  process.working_directory like "/tmp/newroot"
)