detection.wiki

Detection rules › Elastic

Suspicious Echo Execution

Source
github.com/elastic/protections-artifacts

This rule detects the execution of the echo command to write data to potential persistence files, decode base64/32/16 and hex content or establish connections to a potential C2. The echo command is used to display a line of text or write data to a file. Threat actors may abuse the echo command to write data to files or file descriptors that are executed (by other processes or services) to establish persistence or escalate privileges.

MITRE ATT&CK coverage

TacticTechniques
Execution
Persistence
Privilege Escalation
Stealth
Command & Control

Rule body

[rule]
description = """
This rule detects the execution of the echo command to write data to potential persistence files, decode base64/32/16
and hex content or establish connections to a potential C2. The echo command is used to display a line of text or write
data to a file. Threat actors may abuse the echo command to write data to files or file descriptors that are executed
(by other processes or services) to establish persistence or escalate privileges.
"""
id = "bc8a7958-dabb-42e5-b23c-6e3472cf395d"
license = "Elastic License v2"
name = "Suspicious Echo Execution"
os_list = ["linux"]
version = "1.0.9"

query = '''
process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox", "pwsh") and
process.args in ("-c", "--command", "-lc", "-cl") and process.args like "echo *" and (
  process.parent.name in (
    "bash", "dash", "zsh", "sh", "ksh", "tcsh", "fish", "mksh", "busybox", "logger", "pkexec", "watch", "pwsh",
    "awk", "nawk", "mawk", "gawk", "tmux", "env", "coreutils", "dnf", "yum", "apt", "dpkg", "splunkd",
    "agent_caldera", "vi", "vim", "nvim", "podman-compose", "nsenter"
  ) or
  process.parent.name like (".*", "*.sh", "*.py", "*.lua", "*.pl", "*.rb", "*.bin") or
  process.parent.executable like (
    ".", "/etc/profile.d/*",
    "/tmp/*", "/var/tmp/*", "/home/*/*", "/root/*",
    "/www/*", "/var/www/*", "/var/lib/docker/overlay2/*",
    "/run/user/*", "/var/run/user/*", "/dev/shm/*"
  ) or
  (process.parent.name == "timeout" and not process.command_line like (
    "*>*/tmp/*", "*/usr/bin/env*processor*cpuinfo*physical*", "*/usr/sbin/ssh_alert_interm.sh*"
  )) or
  (process.parent.name == "php" and not process.command_line like (
    "*/tmp/cacti/net-snmp-devio*", "*/centreon/cron/centAcl.php*", "*localhost*", "sh -c echo -n > /var/www/html/cacti/log/cacti.log",
    "*/opt/naoned/inao/current/system/tools/cron.d/crontab_install.php*", "*nohup*"
  )) or
  (process.parent.name like "ruby*" and not process.command_line like "*/usr/bin/env*processor*cpuinfo*physical*") or
  (process.parent.name like "perl*" and not process.command_line like ("*echo*>*/var/tmp/mail*", "*echo*>*/tmp/db2_tmp.cmd")) or
  (process.parent.name like "python*" and not (
    process.command_line like (
      "*/var/consul-conf*", "*BACKUP_PATH*", "*archive.ubuntu.com*", "*haproxy/haproxy.sock*", "*XDG_RUNTIME_DIR*", "*/var/log/nginx*"
    ) or
    process.args like ("declare*", "files=*", "entries=*", "required_cmds=*", "suid_max=*")
  )) or
  (process.parent.name == "java" and not process.command_line like "*/var/log/jobprocessor/audit.log*") or
  (process.parent.name == "dash" and not process.args like ("/srv/tools/managed/update.sh", "exp=$*"))
) and process.command_line like (

  /* Encoding, Decoding & Piping */
  "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
  "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
  "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
  "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",

  /* File Manipulation */
  "*> /tmp/*", "*>> /tmp/*", "*>/tmp/*", "*>>/tmp/*",
  "*> /var/tmp/*", "*>> /var/tmp/*", "*>/var/tmp/*", "*>>/var/tmp/*",
  "*> /dev/shm/*", "*>> /dev/shm/*", "*>/dev/shm/*", "*>>/dev/shm/*",
  "*> /run/*", "*>> /run/*", "*>/run/*", "*>>/run/*",
  "*> /var/run/*", "*>> /var/run/*", "*>/var/run/*", "*>>/var/run/*",
  "*> /var/www/*", "*>> /var/www/*", "*>/var/www/*", "*>>/var/www/*",

  /* Persistence */
  "*>*/etc/cron*", "*crontab*", "*>*/home/*/.ssh/*", "*>*/root/.ssh*", "*>*~/.ssh/*", "*>*/etc/shadow*", "*>*/etc/passwd*",
  "*>*/etc/master.passwd*", "*chpasswd*", "*NOPASSWD:ALL*>*sudoers.d*", "*>*/etc/systemd/system/*[Unit]*ExecStart*",
  "*| crontab -*",

  /* Decompression */
  "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",

  /* Miscellaneous */
  "* setsid *", "*timeout *sh -c *", "*disown*",  "*chattr *", "busybox *", "*#!/*", "*chmod +x *", "*chmod 777*",
  "*<?php*?>*", "*kworker*", "*stty*raw*-echo*", "*mkfifo /tmp/*"
) and
not (
  process.parent.executable like (
    "/usr/share/cursor/cursor", "/opt/teleport/system/bin/teleport", "/root/.cursor-server/*", "/home/*/.cursor-server/*",
    "/usr/sbin/qemu-ga", "/usr/bin/node", "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64",
    "./runc", "/home/*/.conda/envs/fmf_server_agent/bin/python*", "/home/*/*claude*", "/home/*/.nvm/*", "/tmp/newroot/usr/bin/node",
    "/tmp/newroot/home/*/*claude*", "/tmp/.mount_Curso*/cursor", "/tmp/newroot/newroot/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent",
    "/tmp/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent", "/tmp/newroot/usr/bin/sudo", "/tmp/newroot/newroot/usr/bin/sudo",
    "/var/lib/docker/overlay2/*cron", "/home/*/.vscode-server/*/codex", "/home/*/pnpm/*", "/root/.nvm/*", "./buildkit-runc",
    "/opt/Tanium/TaniumClient/extensions/comply/jre/bin/java", "/root/*/claude*", "/var/lib/docker/overlay2/*executor",
    "/tmp/.mount_arduin*/arduino-cli", "/home/*/.vscode/*/codex", "/tmp/petalinux*/make", "/tmp/newroot/*/codex",
    "/home/*/.local/bin/kiro-cli-chat", "/tmp/newroot/usr/bin/claude-bin", "/tmp/newroot/usr/bin/make", "/home/*/usr/bin/make",
    "/tmp/newroot/newroot/home/*/.local/bin/kiro-cli-chat", "/home/*/crux/bin/nexus_exec", "/tmp/CVU_19_resource_*/exectask",
    "/var/lib/docker/overlay2/*/rc.init", "/var/lib/docker/overlay2/*/usr/bin/make", "/home/*/.local/*python*",
    "/tmp/CVU_*_resource/exectask", "/root/please/plz-out/bin/package/please", "/tmp/newroot/*", "/var/lib/docker/overlay2/*/longhorn",
    "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
    "/root/.vscode-server/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.elixir-install/installs/*/bin/erl_child_setup",
    "/var/lib/docker/overlay2/*/usr/sbin/sshd", "/home/*/please/please/plz-out/bin/package/please",
    "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode", "/home/*/couscous/ci-bin/kuttl", "/home/kali/.opencode/bin/opencode",
    "/tmp/pytorch_build/pytorch-build-venv/bin/ninja", "/home/*/.opencode/bin/opencode", "/home/*/.local/share/JetBrains/Toolbox/apps/*/bin/rustrover",
    "/home/*/kubernetes/terraform/harvester/.terraform/providers/registry.terraform.io/hashicorp/external/*", "/home/linuxbrew/.linuxbrew/Cellar/fzf/*/bin/fzf",
    "/home/*/Documents/please/plz-out/bin/package/please", "/home/*/.npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
    "/home/*/.aimee-code/bin/opencode", "/home/linuxbrew/.linuxbrew/Cellar/tilt/*/bin/tilt", "/opt/Elastic/Endpoint/elastic-endpoint",
    "/home/*/.local/bin/droid", "/opt/saltstack/salt/bin/python3.*", "/home/*/please/plz-out/bin/package/please", "/home/*/.fzf/bin/fzf",
    "/home/*/spack/opt/spack/linux-cascadelake/*/bin/make", "/home/*/.local/share/fnm/node-versions/*/bin/node", "/home/coder/omni", "/home/*/toolchain/bin/make",
    "/tmp/coder.*/coder", "/home/*/.vscode-server/extensions/kilocode.*/bin/kilo", "/opt/zimbra/libexec/zmsetup.pl", "/ztank/sw/eb/sw/Perl/*/bin/perl"
  ) or
  (process.parent.name in ("vim", "vi", "nvim") and process.parent.command_line like ("*/usr/share/vim/vimfiles/doc*", "*vimglob*")) or
  process.parent.name like "php-fpm*" or
  process.parent.command_line in (
    "openclaw-gateway", "runc init", "/usr/bin/perl -w /usr/bin/collectl -D", "/usr/bin/runc init",
    "sh -c /usr/bin/php -q /usr/share/cacti/script_server.php cmd", "ruby /root/./vpentest.rb first-connect"
  ) or
  process.parent.command_line like ("*/home/*/.claude/shell-snapshots/*", "/usr/local/cpanel/3rdparty/perl/*/bin/perl -w t/tools-validate_spec.t") or
  process.command_line in (
    "bash -c echo \"#!/bin/bash\" > /usr/sbin/ssh_alert_interm.sh",
    "/bin/sh -c timeout 20 bash -c 'set -o pipefail; which openssl &>/dev/null; echo $?'",
    """/bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.limit_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.max; else echo 0; fi'""",
    """/bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.usage_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.current; else echo 0; fi'""",
    "/bin/sh -c echo $(date) > /tmp/salt_keepalive_ping", "sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci --production;"
  ) or
  process.command_line like (
    "*timeout*/usr/local/logicmonitor/agent/bin/logicmonitor-agent.java.pid*", "*timeout*/.claude/shell-snapshots/snapshot*",
    "*/root/.claude/shell-snapshots/*", "*raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh*",
    "*srv/tools/managed/update.sh*", "*home/*/.claude/shell-snapshots/*", "sh -c echo 'WrLNwLrcrxM=' | base64 -d > /home/*/.vnc/passwd",
    "/bin/sh -c echo $(date) > /tmp/salt_keepalive_ping", "sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci;",
    "*echo blkid: > /tmp/vmware-*/blkid.txt;/sbin/blkid*", "*/dev/tcp/traefik-gate.service.consul/10041*"
  ) or
  process.working_directory like (
    "/root/.cache/act/*/hostexecutor", "/home/*/KSPL/COZY_RUN", "/home/jenkins/agent/workspace/*", "/opt/beginfinite/reload/lib/code",
    "/tmp/plz_sandbox"
  ) or
  process.args like ("snap=$(*", "if [ -x *", "/u01/*/grid/bin/clsecho*", "php artisan reverb:start*") or
  process.parent.args like ("/var/tmp/ansible-tmp-*/AnsiballZ_command.py", "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_command.py") or
  (process.parent.command_line == "bash /entrypoint.sh" and process.command_line like "*/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog.java.pid*") or
  (process.parent.executable == "/usr/bin/perl" and process.parent.args like "/home/*/scripts/daily.pl") or
  (process.working_directory == "/var/opt/OV/installation/standalone" and process.parent.executable in ("/usr/bin/awk", "/usr/bin/gawk")) or
  (process.working_directory == "/home/deploy" and process.parent.executable like "/usr/bin/python3.*" and process.command_line like "*/home/manage/.ssh/authorized_keys*") or
  (process.working_directory like "/var/tmp/glibc-*/glibc-*" and process.parent.executable == "/tmp/homebrew/bin/make") or
  (process.working_directory like "/tmp/MLNX_OFED_LINUX*" and process.parent.executable == "/usr/bin/perl") or
  (process.parent.executable == "/usr/local/admin/bin/mailman_bsc_listadd_v2.py" and process.command_line like "*/tmp/mailmanListMembers.txt") or
  (process.parent.executable like "/home/*/.local/opt/node-*-linux-x64/bin/node" and process.command_line like "*extglob*") or
  (process.working_directory == "/home/navi" and process.command_line like "sh -c echo*| base64 -d | sudo -n tee \"/etc/hosts\" > /dev/null") or
  (
    process.parent.executable == "/usr/bin/perl" and
    process.parent.args in (
      "/opt/scom/bin/misc-plugins/check_nfs_client.pl", "/apps/sapinst/script/sapservices_maintainer.pl", "/special/common/bin/chp.pl"
    )
  ) or
  (process.parent.executable like "/tmp/portable_install_*/bomc.bin" and process.command_line like "*/tmp/healer/log/Lenovo_Support/bomc_*") or
  (process.command_line like "*/home/ec2-user/.ssh/authorized_keys*" and process.parent.name like "python*" and process.parent.args == "/opt/aws/bin/cfn-init") or
  (process.parent.name == "python2" and process.parent.args == "/tmp/WSGUPInstall/setup/unified-installer.py") or
  (process.working_directory == "/home/svc-ansible" and process.parent.name like "python3*") or
  (process.parent.name like "python3*" and process.parent.command_line like "*mitogen*")
)
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1037"
name = "Boot or Logon Initialization Scripts"
reference = "https://attack.mitre.org/techniques/T1037/"

[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"


[[threat.technique]]
id = "T1546"
name = "Event Triggered Execution"
reference = "https://attack.mitre.org/techniques/T1546/"
[[threat.technique.subtechnique]]
id = "T1546.004"
name = "Unix Shell Configuration Modification"
reference = "https://attack.mitre.org/techniques/T1546/004/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1053"
name = "Scheduled Task/Job"
reference = "https://attack.mitre.org/techniques/T1053/"
[[threat.technique.subtechnique]]
id = "T1053.003"
name = "Cron"
reference = "https://attack.mitre.org/techniques/T1053/003/"



[threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1027"
name = "Obfuscated Files or Information"
reference = "https://attack.mitre.org/techniques/T1027/"

[[threat.technique]]
id = "T1140"
name = "Deobfuscate/Decode Files or Information"
reference = "https://attack.mitre.org/techniques/T1140/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"

Stages and Predicates

Stage 1: process

process where event.type == "start" and event.action == "exec" and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "mksh", "busybox", "pwsh") and
process.args in ("-c", "--command", "-lc", "-cl") and process.args like "echo *" and (
  process.parent.name in (
    "bash", "dash", "zsh", "sh", "ksh", "tcsh", "fish", "mksh", "busybox", "logger", "pkexec", "watch", "pwsh",
    "awk", "nawk", "mawk", "gawk", "tmux", "env", "coreutils", "dnf", "yum", "apt", "dpkg", "splunkd",
    "agent_caldera", "vi", "vim", "nvim", "podman-compose", "nsenter"
  ) or
  process.parent.name like (".*", "*.sh", "*.py", "*.lua", "*.pl", "*.rb", "*.bin") or
  process.parent.executable like (
    ".", "/etc/profile.d/*",
    "/tmp/*", "/var/tmp/*", "/home/*/*", "/root/*",
    "/www/*", "/var/www/*", "/var/lib/docker/overlay2/*",
    "/run/user/*", "/var/run/user/*", "/dev/shm/*"
  ) or
  (process.parent.name == "timeout" and not process.command_line like (
    "*>*/tmp/*", "*/usr/bin/env*processor*cpuinfo*physical*", "*/usr/sbin/ssh_alert_interm.sh*"
  )) or
  (process.parent.name == "php" and not process.command_line like (
    "*/tmp/cacti/net-snmp-devio*", "*/centreon/cron/centAcl.php*", "*localhost*", "sh -c echo -n > /var/www/html/cacti/log/cacti.log",
    "*/opt/naoned/inao/current/system/tools/cron.d/crontab_install.php*", "*nohup*"
  )) or
  (process.parent.name like "ruby*" and not process.command_line like "*/usr/bin/env*processor*cpuinfo*physical*") or
  (process.parent.name like "perl*" and not process.command_line like ("*echo*>*/var/tmp/mail*", "*echo*>*/tmp/db2_tmp.cmd")) or
  (process.parent.name like "python*" and not (
    process.command_line like (
      "*/var/consul-conf*", "*BACKUP_PATH*", "*archive.ubuntu.com*", "*haproxy/haproxy.sock*", "*XDG_RUNTIME_DIR*", "*/var/log/nginx*"
    ) or
    process.args like ("declare*", "files=*", "entries=*", "required_cmds=*", "suid_max=*")
  )) or
  (process.parent.name == "java" and not process.command_line like "*/var/log/jobprocessor/audit.log*") or
  (process.parent.name == "dash" and not process.args like ("/srv/tools/managed/update.sh", "exp=$*"))
) and process.command_line like (
  "*|sh", "*| sh *", "*| sh ", "*|bash*", "*| bash*", "*|zsh*",  "*| zsh*", "*|dash*",  "*| dash*",
  "*|python*", "*| python*", "*|php*", "*| php*", "*|perl*", "*| perl*", "*|ruby*", "*| ruby*",
  "*|node*", "*| node*", "*|lua*",  "*| lua*", "*|busybox*", "*| busybox*", "*|*base64 -d*", "*|*base64 --decode*",
  "*|*base64 --decode*", "*|*openssl base64 -d*", "*xxd *", "*| openssl*enc * -d *", "*b64decode -r*",
  "*> /tmp/*", "*>> /tmp/*", "*>/tmp/*", "*>>/tmp/*",
  "*> /var/tmp/*", "*>> /var/tmp/*", "*>/var/tmp/*", "*>>/var/tmp/*",
  "*> /dev/shm/*", "*>> /dev/shm/*", "*>/dev/shm/*", "*>>/dev/shm/*",
  "*> /run/*", "*>> /run/*", "*>/run/*", "*>>/run/*",
  "*> /var/run/*", "*>> /var/run/*", "*>/var/run/*", "*>>/var/run/*",
  "*> /var/www/*", "*>> /var/www/*", "*>/var/www/*", "*>>/var/www/*",
  "*>*/etc/cron*", "*crontab*", "*>*/home/*/.ssh/*", "*>*/root/.ssh*", "*>*~/.ssh/*", "*>*/etc/shadow*", "*>*/etc/passwd*",
  "*>*/etc/master.passwd*", "*chpasswd*", "*NOPASSWD:ALL*>*sudoers.d*", "*>*/etc/systemd/system/*[Unit]*ExecStart*",
  "*| crontab -*",
  "*gzip -*d *", "*bzip2 -*d *", "*xz -*d *", "*tar -*x*",
  "* setsid *", "*timeout *sh -c *", "*disown*",  "*chattr *", "busybox *", "*#!/*", "*chmod +x *", "*chmod 777*",
  "*<?php*?>*", "*kworker*", "*stty*raw*-echo*", "*mkfifo /tmp/*"
) and
not (
  process.parent.executable like (
    "/usr/share/cursor/cursor", "/opt/teleport/system/bin/teleport", "/root/.cursor-server/*", "/home/*/.cursor-server/*",
    "/usr/sbin/qemu-ga", "/usr/bin/node", "/usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64",
    "./runc", "/home/*/.conda/envs/fmf_server_agent/bin/python*", "/home/*/*claude*", "/home/*/.nvm/*", "/tmp/newroot/usr/bin/node",
    "/tmp/newroot/home/*/*claude*", "/tmp/.mount_Curso*/cursor", "/tmp/newroot/newroot/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent",
    "/tmp/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent", "/tmp/newroot/usr/bin/sudo", "/tmp/newroot/newroot/usr/bin/sudo",
    "/var/lib/docker/overlay2/*cron", "/home/*/.vscode-server/*/codex", "/home/*/pnpm/*", "/root/.nvm/*", "./buildkit-runc",
    "/opt/Tanium/TaniumClient/extensions/comply/jre/bin/java", "/root/*/claude*", "/var/lib/docker/overlay2/*executor",
    "/tmp/.mount_arduin*/arduino-cli", "/home/*/.vscode/*/codex", "/tmp/petalinux*/make", "/tmp/newroot/*/codex",
    "/home/*/.local/bin/kiro-cli-chat", "/tmp/newroot/usr/bin/claude-bin", "/tmp/newroot/usr/bin/make", "/home/*/usr/bin/make",
    "/tmp/newroot/newroot/home/*/.local/bin/kiro-cli-chat", "/home/*/crux/bin/nexus_exec", "/tmp/CVU_19_resource_*/exectask",
    "/var/lib/docker/overlay2/*/rc.init", "/var/lib/docker/overlay2/*/usr/bin/make", "/home/*/.local/*python*",
    "/tmp/CVU_*_resource/exectask", "/root/please/plz-out/bin/package/please", "/tmp/newroot/*", "/var/lib/docker/overlay2/*/longhorn",
    "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
    "/root/.vscode-server/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex", "/home/*/.elixir-install/installs/*/bin/erl_child_setup",
    "/var/lib/docker/overlay2/*/usr/sbin/sshd", "/home/*/please/please/plz-out/bin/package/please",
    "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode", "/home/*/couscous/ci-bin/kuttl", "/home/kali/.opencode/bin/opencode",
    "/tmp/pytorch_build/pytorch-build-venv/bin/ninja", "/home/*/.opencode/bin/opencode", "/home/*/.local/share/JetBrains/Toolbox/apps/*/bin/rustrover",
    "/home/*/kubernetes/terraform/harvester/.terraform/providers/registry.terraform.io/hashicorp/external/*", "/home/linuxbrew/.linuxbrew/Cellar/fzf/*/bin/fzf",
    "/home/*/Documents/please/plz-out/bin/package/please", "/home/*/.npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex",
    "/home/*/.aimee-code/bin/opencode", "/home/linuxbrew/.linuxbrew/Cellar/tilt/*/bin/tilt", "/opt/Elastic/Endpoint/elastic-endpoint",
    "/home/*/.local/bin/droid", "/opt/saltstack/salt/bin/python3.*", "/home/*/please/plz-out/bin/package/please", "/home/*/.fzf/bin/fzf",
    "/home/*/spack/opt/spack/linux-cascadelake/*/bin/make", "/home/*/.local/share/fnm/node-versions/*/bin/node", "/home/coder/omni", "/home/*/toolchain/bin/make",
    "/tmp/coder.*/coder", "/home/*/.vscode-server/extensions/kilocode.*/bin/kilo", "/opt/zimbra/libexec/zmsetup.pl", "/ztank/sw/eb/sw/Perl/*/bin/perl"
  ) or
  (process.parent.name in ("vim", "vi", "nvim") and process.parent.command_line like ("*/usr/share/vim/vimfiles/doc*", "*vimglob*")) or
  process.parent.name like "php-fpm*" or
  process.parent.command_line in (
    "openclaw-gateway", "runc init", "/usr/bin/perl -w /usr/bin/collectl -D", "/usr/bin/runc init",
    "sh -c /usr/bin/php -q /usr/share/cacti/script_server.php cmd", "ruby /root/./vpentest.rb first-connect"
  ) or
  process.parent.command_line like ("*/home/*/.claude/shell-snapshots/*", "/usr/local/cpanel/3rdparty/perl/*/bin/perl -w t/tools-validate_spec.t") or
  process.command_line in (
    "bash -c echo \"#!/bin/bash\" > /usr/sbin/ssh_alert_interm.sh",
    "/bin/sh -c timeout 20 bash -c 'set -o pipefail; which openssl &>/dev/null; echo $?'",
    """/bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.limit_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.max; else echo 0; fi'""",
    """/bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.usage_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.current; else echo 0; fi'""",
    "/bin/sh -c echo $(date) > /tmp/salt_keepalive_ping", "sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci --production;"
  ) or
  process.command_line like (
    "*timeout*/usr/local/logicmonitor/agent/bin/logicmonitor-agent.java.pid*", "*timeout*/.claude/shell-snapshots/snapshot*",
    "*/root/.claude/shell-snapshots/*", "*raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh*",
    "*srv/tools/managed/update.sh*", "*home/*/.claude/shell-snapshots/*", "sh -c echo 'WrLNwLrcrxM=' | base64 -d > /home/*/.vnc/passwd",
    "/bin/sh -c echo $(date) > /tmp/salt_keepalive_ping", "sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci;",
    "*echo blkid: > /tmp/vmware-*/blkid.txt;/sbin/blkid*", "*/dev/tcp/traefik-gate.service.consul/10041*"
  ) or
  process.working_directory like (
    "/root/.cache/act/*/hostexecutor", "/home/*/KSPL/COZY_RUN", "/home/jenkins/agent/workspace/*", "/opt/beginfinite/reload/lib/code",
    "/tmp/plz_sandbox"
  ) or
  process.args like ("snap=$(*", "if [ -x *", "/u01/*/grid/bin/clsecho*", "php artisan reverb:start*") or
  process.parent.args like ("/var/tmp/ansible-tmp-*/AnsiballZ_command.py", "/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_command.py") or
  (process.parent.command_line == "bash /entrypoint.sh" and process.command_line like "*/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog.java.pid*") or
  (process.parent.executable == "/usr/bin/perl" and process.parent.args like "/home/*/scripts/daily.pl") or
  (process.working_directory == "/var/opt/OV/installation/standalone" and process.parent.executable in ("/usr/bin/awk", "/usr/bin/gawk")) or
  (process.working_directory == "/home/deploy" and process.parent.executable like "/usr/bin/python3.*" and process.command_line like "*/home/manage/.ssh/authorized_keys*") or
  (process.working_directory like "/var/tmp/glibc-*/glibc-*" and process.parent.executable == "/tmp/homebrew/bin/make") or
  (process.working_directory like "/tmp/MLNX_OFED_LINUX*" and process.parent.executable == "/usr/bin/perl") or
  (process.parent.executable == "/usr/local/admin/bin/mailman_bsc_listadd_v2.py" and process.command_line like "*/tmp/mailmanListMembers.txt") or
  (process.parent.executable like "/home/*/.local/opt/node-*-linux-x64/bin/node" and process.command_line like "*extglob*") or
  (process.working_directory == "/home/navi" and process.command_line like "sh -c echo*| base64 -d | sudo -n tee \"/etc/hosts\" > /dev/null") or
  (
    process.parent.executable == "/usr/bin/perl" and
    process.parent.args in (
      "/opt/scom/bin/misc-plugins/check_nfs_client.pl", "/apps/sapinst/script/sapservices_maintainer.pl", "/special/common/bin/chp.pl"
    )
  ) or
  (process.parent.executable like "/tmp/portable_install_*/bomc.bin" and process.command_line like "*/tmp/healer/log/Lenovo_Support/bomc_*") or
  (process.command_line like "*/home/ec2-user/.ssh/authorized_keys*" and process.parent.name like "python*" and process.parent.args == "/opt/aws/bin/cfn-init") or
  (process.parent.name == "python2" and process.parent.args == "/tmp/WSGUPInstall/setup/unified-installer.py") or
  (process.working_directory == "/home/svc-ansible" and process.parent.name like "python3*") or
  (process.parent.name like "python3*" and process.parent.command_line like "*mitogen*")
)

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
process.command_lineends_with/tmp/mailmanListMembers.txtexcludes:process.command_line field:"process.command_line" value:"/tmp/mailmanListMembers.txt"
process.parent.executableeq/usr/local/admin/bin/mailman_bsc_listadd_v2.pyexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/local/admin/bin/mailman_bsc_listadd_v2.py"
process.command_linematch/home/ec2-user/.ssh/authorized_keysexcludes:process.command_line field:"process.command_line" value:"/home/ec2-user/.ssh/authorized_keys"
process.parent.argseq/opt/aws/bin/cfn-initexcludes:process.parent.args field:"process.parent.args" value:"/opt/aws/bin/cfn-init"
process.parent.namestarts_withpythonexcludes:process.parent.name field:"process.parent.name" value:"python"
process.command_linematch/home/manage/.ssh/authorized_keysexcludes:process.command_line field:"process.command_line" value:"/home/manage/.ssh/authorized_keys"
process.parent.executablestarts_with/usr/bin/python3.excludes:process.parent.executable field:"process.parent.executable" value:"/usr/bin/python3."
process.working_directoryeq/home/deployexcludes:process.working_directory field:"process.working_directory" value:"/home/deploy"
process.command_linematch/tmp/healer/log/Lenovo_Support/bomc_excludes:process.command_line field:"process.command_line" value:"/tmp/healer/log/Lenovo_Support/bomc_"
process.parent.executablewildcard/tmp/portable_install_*/bomc.binexcludes:process.parent.executable field:"process.parent.executable" value:"/tmp/portable_install_*/bomc.bin"
process.command_linematch/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog.java.pidexcludes:process.command_line field:"process.command_line" value:"/usr/local/logicmonitor/agent/bin/logicmonitor-watchdog.java.pid"
process.parent.command_lineeqbash /entrypoint.shexcludes:process.parent.command_line field:"process.parent.command_line" value:"bash /entrypoint.sh"
process.command_linematchextglobexcludes:process.command_line field:"process.command_line" value:"extglob"
process.parent.executablewildcard/home/*/.local/opt/node-*-linux-x64/bin/nodeexcludes:process.parent.executable field:"process.parent.executable" value:"/home/*/.local/opt/node-*-linux-x64/bin/node"
process.command_linewildcardsh -c echo*| base64 -d | sudo -n tee "/etc/hosts" > /dev/nullexcludes:process.command_line
process.working_directoryeq/home/naviexcludes:process.working_directory field:"process.working_directory" value:"/home/navi"
process.parent.argseq/tmp/WSGUPInstall/setup/unified-installer.pyexcludes:process.parent.args field:"process.parent.args" value:"/tmp/WSGUPInstall/setup/unified-installer.py"
process.parent.nameeqpython2excludes:process.parent.name field:"process.parent.name" value:"python2"
process.parent.argsin/apps/sapinst/script/sapservices_maintainer.pl, /opt/scom/bin/misc-plugins/check_nfs_client.pl, /special/common/bin/chp.plexcludes:process.parent.args field:"process.parent.args" value:"/apps/sapinst/script/sapservices_maintainer.pl" field:"process.parent.args" value:"/opt/scom/bin/misc-plugins/check_nfs_client.pl" field:"process.parent.args" value:"/special/common/bin/chp.pl"
process.parent.executableeq/usr/bin/perlexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/bin/perl"
process.parent.argswildcard/home/*/scripts/daily.plexcludes:process.parent.args field:"process.parent.args" value:"/home/*/scripts/daily.pl"
process.parent.command_linematch/usr/share/vim/vimfiles/doc, vimglobexcludes:process.parent.command_line field:"process.parent.command_line" value:"/usr/share/vim/vimfiles/doc" field:"process.parent.command_line" value:"vimglob"
process.parent.nameinnvim, vi, vimexcludes:process.parent.name field:"process.parent.name" value:"nvim" field:"process.parent.name" value:"vi" field:"process.parent.name" value:"vim"
process.parent.command_linematchmitogenexcludes:process.parent.command_line field:"process.parent.command_line" value:"mitogen"
process.parent.namestarts_withpython3excludes:process.parent.name field:"process.parent.name" value:"python3"
process.parent.executableeq/tmp/homebrew/bin/makeexcludes:process.parent.executable field:"process.parent.executable" value:"/tmp/homebrew/bin/make"
process.working_directorywildcard/var/tmp/glibc-*/glibc-*excludes:process.working_directory field:"process.working_directory" value:"/var/tmp/glibc-*/glibc-*"
process.working_directorystarts_with/tmp/MLNX_OFED_LINUXexcludes:process.working_directory field:"process.working_directory" value:"/tmp/MLNX_OFED_LINUX"
process.parent.executablein/usr/bin/awk, /usr/bin/gawkexcludes:process.parent.executable field:"process.parent.executable" value:"/usr/bin/awk" field:"process.parent.executable" value:"/usr/bin/gawk"
process.working_directoryeq/var/opt/OV/installation/standaloneexcludes:process.working_directory field:"process.working_directory" value:"/var/opt/OV/installation/standalone"
process.working_directoryeq/home/svc-ansibleexcludes:process.working_directory field:"process.working_directory" value:"/home/svc-ansible"
process.argswildcardsnap=$(*, if [ -x *, /u01/*/grid/bin/clsecho*, php artisan reverb:start*excludes:process.args
process.command_linein/bin/sh -c echo $(date) > /tmp/salt_keepalive_ping, /bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.limit_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.max; else echo 0; fi', /bin/sh -c timeout 20 bash -c 'set -o pipefail; uid=$(id -u); if [ -d /sys/fs/cgroup/memory/ysql ]; then cat /sys/fs/cgroup/memory/ysql/memory.usage_in_bytes; elif [ -d /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql ]; then cat /sys/fs/cgroup/user.slice/user-${uid}.slice/user\@${uid}.service/ysql/memory.current; else echo 0; fi', /bin/sh -c timeout 20 bash -c 'set -o pipefail; which openssl &>/dev/null; echo $?', bash -c echo "#!/bin/bash" > /usr/sbin/ssh_alert_interm.sh, sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci --production;excludes:process.command_line
process.command_linewildcard*timeout*/usr/local/logicmonitor/agent/bin/logicmonitor-agent.java.pid*, *timeout*/.claude/shell-snapshots/snapshot*, */root/.claude/shell-snapshots/*, *raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh*, *srv/tools/managed/update.sh*, *home/*/.claude/shell-snapshots/*, sh -c echo 'WrLNwLrcrxM=' | base64 -d > /home/*/.vnc/passwd, /bin/sh -c echo $(date) > /tmp/salt_keepalive_ping, sh -c echo $SSH_PRIVATE_KEY | base64 -di | ssh-add - ; npm ci;, *echo blkid: > /tmp/vmware-*/blkid.txt;/sbin/blkid*, */dev/tcp/traefik-gate.service.consul/10041*excludes:process.command_line
process.parent.argswildcard/var/tmp/ansible-tmp-*/AnsiballZ_command.py, /home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_command.pyexcludes:process.parent.args field:"process.parent.args" value:"/var/tmp/ansible-tmp-*/AnsiballZ_command.py" field:"process.parent.args" value:"/home/*/.ansible/tmp/ansible-tmp-*/AnsiballZ_command.py"
process.parent.command_linein/usr/bin/perl -w /usr/bin/collectl -D, /usr/bin/runc init, openclaw-gateway, ruby /root/./vpentest.rb first-connect, runc init, sh -c /usr/bin/php -q /usr/share/cacti/script_server.php cmdexcludes:process.parent.command_line
process.parent.command_linewildcard*/home/*/.claude/shell-snapshots/*, /usr/local/cpanel/3rdparty/perl/*/bin/perl -w t/tools-validate_spec.texcludes:process.parent.command_line field:"process.parent.command_line" value:"*/home/*/.claude/shell-snapshots/*" field:"process.parent.command_line" value:"/usr/local/cpanel/3rdparty/perl/*/bin/perl -w t/tools-validate_spec.t"
process.parent.executablewildcard/usr/share/cursor/cursor, /opt/teleport/system/bin/teleport, /root/.cursor-server/*, /home/*/.cursor-server/*, /usr/sbin/qemu-ga, /usr/bin/node, /usr/share/windsurf/resources/app/extensions/windsurf/bin/language_server_linux_x64, ./runc, /home/*/.conda/envs/fmf_server_agent/bin/python*, /home/*/*claude*, /home/*/.nvm/*, /tmp/newroot/usr/bin/node, /tmp/newroot/home/*/*claude*, /tmp/.mount_Curso*/cursor, /tmp/newroot/newroot/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent, /tmp/newroot/opt/omnissa/ws1-hub/bin/ws1HubAgent, /tmp/newroot/usr/bin/sudo, /tmp/newroot/newroot/usr/bin/sudo, /var/lib/docker/overlay2/*cron, /home/*/.vscode-server/*/codex, /home/*/pnpm/*, /root/.nvm/*, ./buildkit-runc, /opt/Tanium/TaniumClient/extensions/comply/jre/bin/java, /root/*/claude*, /var/lib/docker/overlay2/*executor, /tmp/.mount_arduin*/arduino-cli, /home/*/.vscode/*/codex, /tmp/petalinux*/make, /tmp/newroot/*/codex, /home/*/.local/bin/kiro-cli-chat, /tmp/newroot/usr/bin/claude-bin, /tmp/newroot/usr/bin/make, /home/*/usr/bin/make, /tmp/newroot/newroot/home/*/.local/bin/kiro-cli-chat, /home/*/crux/bin/nexus_exec, /tmp/CVU_19_resource_*/exectask, /var/lib/docker/overlay2/*/rc.init, /var/lib/docker/overlay2/*/usr/bin/make, /home/*/.local/*python*, /tmp/CVU_*_resource/exectask, /root/please/plz-out/bin/package/please, /tmp/newroot/*, /var/lib/docker/overlay2/*/longhorn, /home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode, /root/.vscode-server/extensions/openai.chatgpt-*-linux-x64/bin/linux-x86_64/codex, /home/*/.elixir-install/installs/*/bin/erl_child_setup, /var/lib/docker/overlay2/*/usr/sbin/sshd, /home/*/please/please/plz-out/bin/package/please, /usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode, /home/*/couscous/ci-bin/kuttl, /home/kali/.opencode/bin/opencode, /tmp/pytorch_build/pytorch-build-venv/bin/ninja, /home/*/.opencode/bin/opencode, /home/*/.local/share/JetBrains/Toolbox/apps/*/bin/rustrover, /home/*/kubernetes/terraform/harvester/.terraform/providers/registry.terraform.io/hashicorp/external/*, /home/linuxbrew/.linuxbrew/Cellar/fzf/*/bin/fzf, /home/*/Documents/please/plz-out/bin/package/please, /home/*/.npm-global/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/codex/codex, /home/*/.aimee-code/bin/opencode, /home/linuxbrew/.linuxbrew/Cellar/tilt/*/bin/tilt, /opt/Elastic/Endpoint/elastic-endpoint, /home/*/.local/bin/droid, /opt/saltstack/salt/bin/python3.*, /home/*/please/plz-out/bin/package/please, /home/*/.fzf/bin/fzf, /home/*/spack/opt/spack/linux-cascadelake/*/bin/make, /home/*/.local/share/fnm/node-versions/*/bin/node, /home/coder/omni, /home/*/toolchain/bin/make, /tmp/coder.*/coder, /home/*/.vscode-server/extensions/kilocode.*/bin/kilo, /opt/zimbra/libexec/zmsetup.pl, /ztank/sw/eb/sw/Perl/*/bin/perlexcludes:process.parent.executable
process.parent.namestarts_withphp-fpmexcludes:process.parent.name field:"process.parent.name" value:"php-fpm"
process.working_directorywildcard/root/.cache/act/*/hostexecutor, /home/*/KSPL/COZY_RUN, /home/jenkins/agent/workspace/*, /opt/beginfinite/reload/lib/code, /tmp/plz_sandboxexcludes:process.working_directory

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
event.actioneq
  • exec
field:"EventType" kind:eq value:"exec"
event.typeeq
  • start
field:"event.type" kind:eq value:"start"
process.argsin
  • --command
  • -c
  • -cl
  • -lc
field:"process.args" kind:in
process.argswildcard
  • echo *
field:"process.args" kind:wildcard value:"echo *"
process.command_linewildcard
  • * setsid *
  • *#!/*
  • *<?php*?>*
  • *> /dev/shm/*
  • *> /run/*
  • *> /tmp/*
  • *> /var/run/*
  • *> /var/tmp/*
  • *> /var/www/*
  • *>*/etc/cron*
  • *>*/etc/master.passwd*
  • *>*/etc/passwd*
  • *>*/etc/shadow*
  • *>*/etc/systemd/system/*[Unit]*ExecStart*
  • *>*/home/*/.ssh/*
  • *>*/root/.ssh*
  • *>*~/.ssh/*
  • *>/dev/shm/*
  • *>/run/*
  • *>/tmp/*
  • *>/var/run/*
  • *>/var/tmp/*
  • *>/var/www/*
  • *>> /dev/shm/*
  • *>> /run/*
  • *>> /tmp/*
  • *>> /var/run/*
  • *>> /var/tmp/*
  • *>> /var/www/*
  • *>>/dev/shm/*
  • *>>/run/*
  • *>>/tmp/*
  • *>>/var/run/*
  • *>>/var/tmp/*
  • *>>/var/www/*
  • *NOPASSWD:ALL*>*sudoers.d*
  • *b64decode -r*
  • *bzip2 -*d *
  • *chattr *
  • *chmod +x *
  • +41 more values (see full rule source)
field:"CommandLine" kind:wildcard
process.namein
  • bash
  • busybox
  • csh
  • dash
  • fish
  • ksh
  • mksh
  • pwsh
  • sh
  • tcsh
  • zsh
field:"process_name" kind:in
process.parent.executablewildcard
  • .
  • /dev/shm/*
  • /etc/profile.d/*
  • /home/*/*
  • /root/*
  • /run/user/*
  • /tmp/*
  • /var/lib/docker/overlay2/*
  • /var/run/user/*
  • /var/tmp/*
  • /var/www/*
  • /www/*
field:"ParentImage" kind:wildcard
process.parent.nameeq
  • dash
  • java
  • php
  • timeout
field:"parent_process_name" kind:eq
process.parent.namein
  • agent_caldera
  • apt
  • awk
  • bash
  • busybox
  • coreutils
  • dash
  • dnf
  • dpkg
  • env
  • fish
  • gawk
  • ksh
  • logger
  • mawk
  • mksh
  • nawk
  • nsenter
  • nvim
  • pkexec
  • podman-compose
  • pwsh
  • sh
  • splunkd
  • tcsh
  • tmux
  • vi
  • vim
  • watch
  • yum
  • zsh
field:"parent_process_name" kind:in
process.parent.namewildcard
  • *.bin
  • *.lua
  • *.pl
  • *.py
  • *.rb
  • *.sh
  • .*
  • perl*
  • python*
  • ruby*
field:"parent_process_name" kind:wildcard