✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.process-* METADATA _id, _version, _index
| WHERE KQL("""event.category:process and event.type:start""")
  AND TO_LOWER(process.parent.name) LIKE "python*"
  AND (
    TO_LOWER(process.parent.command_line) LIKE """*\\ray\\_private\\workers\\default_worker.py*"""
    OR TO_LOWER(process.parent.command_line) LIKE "*/ray/_private/workers/default_worker.py*"
  )
  AND (
    TO_LOWER(process.name) IN (
      "cmd.exe", "powershell.exe", "pwsh.exe",
      "bash", "bash.exe", "sh", "zsh", "dash",
      "curl", "curl.exe", "wget", "wget.exe",
      "whoami", "whoami.exe", "id", "uname", "hostname", "hostname.exe"
    )
    // Direct python -c child of the worker.
    OR (
      TO_LOWER(process.name) LIKE "python*"
      AND MV_CONTAINS(process.args, "-c")
    )
  )
| KEEP
    _id,
    _version,
    _index,
    data_stream.namespace,
    @timestamp,
    host.name,
    host.id,
    host.os.type,
    agent.id,
    user.name,
    user.domain,
    process.name,
    process.executable,
    process.command_line,
    process.args,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line,
    process.parent.entity_id