process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start") and process.parent.executable : (
  "/usr/sbin/nginx", "/usr/local/sbin/nginx",
  "/usr/sbin/apache", "/usr/local/sbin/apache",
  "/usr/sbin/apache2", "/usr/local/sbin/apache2",
  "/usr/sbin/php*", "/usr/local/sbin/php*",
  "/usr/sbin/lighttpd", "/usr/local/sbin/lighttpd",
  "/usr/sbin/hiawatha", "/usr/local/sbin/hiawatha",
  "/usr/local/bin/caddy", 
  "/usr/local/lsws/bin/lswsctrl",
  "*/bin/catalina.sh"
) and
process.name : (
  "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "python*", "php*", "perl", "ruby", "lua*", "openssl", "nc",
  "netcat", "ncat", "telnet", "awk", "socat"
  ) and process.args : (
  "whoami", "id", "uname", "cat", "hostname", "ip", "curl", "wget", "pwd", "ls", "cd", "python*", "php*", "perl",
  "ruby", "lua*", "openssl", "nc", "netcat", "ncat", "telnet", "awk", "socat"
  ) and not process.name == "phpquery"