✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "executed", "process_started", "start", "ProcessRollup2") and
?process.parent.executable != null and
(
  (process.name == "bash" and process.args == "-c" and process.args like "* enable *-f*.so*") or
  (process.name == "openssl" and process.args == "-engine" and process.args like "*.so*") or
  (process.name like "python*" and process.args == "-c" and process.args like "*cdll.LoadLibrary*.so*") or
  (process.name like "ruby*" and process.args == "-e" and process.args like "*Fiddle.dlopen*.so*") or 
  (process.name in ("gdb", "gimp", "rview", "rvim", "view", "vim", "vimdiff") and
   process.args like "*cdll.LoadLibrary*.so*") or
  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args == "-c" and process.args like ("*cdll.LoadLibrary*.so*", "*ruby*-e**Fiddle.dlopen*.so*")
  )
) and
not (
  ?process.parent.executable like (
    "/root/.cache/bazel/_bazel_root/install/*", "/opt/Xilinx/PetaLinux/*", "/usr/bin/find", "/bin/find", 
    "/opt/nessus_agent/sbin/nessus-agent-module", "/sw/eb/sw/Python/*/bin/python*"
  ) or
  ?process.parent.name in ("make", "process-wrapper", "bwrap") or
  (process.name like "python*" and ?process.command_line like~ "*import torch*torchinductor*") or
  ?process.command_line like "*https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE*"
)