✄𐘗
text code block:
✄𐘗process where host.os.type in ("linux", "macos", "windows") and event.type == "start" and
event.action like ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started", "Process Create*") and
(
  process.name in~ (
    "curl", "curl.exe", "wget", "wget.exe", "bash", "dash", "sh", "tcsh", "tclsh", "wish",
    "csh", "zsh", "ksh", "fish", "mksh", "busybox", "powershell.exe", "cmd.exe", "pwsh.exe", "pwsh"
  ) or
  process.name like~ (".*", "python*", "perl*", "ruby*", "php*", "lua*", "java*") or
  ?process.executable like~ (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*/*", "/var/run/*", "/run/*", "/boot/*", "/.*", "C:\\Users\\*",
    "?:\\ProgramData\\*", "/var/www/*", "./*"
  )
) and
process.args like~ (
  "*/latest/meta-data/iam/security-credentials/?*",
  "*computeMetadata/v1/instance/service-accounts/*/oauth2/access_token*",
  "*/metadata/identity/oauth2/token*resource=*"
)