Background Task Execution via a Hidden Process

process where event.type == "start" and event.action == "exec" and
(process.parent.name like ".*" or process.name like ".*") and
(process.parent.args like "*&" or process.args like "*&") and
not (
  process.parent.command_line in ("runc init", "/usr/bin/runc init", "claude") or
  process.parent.executable like (
    ".", "/usr/bin/podman", "./.runc-wrapped", "/nix/store/*", "/dev/.buildkit_qemu_emulator",
    "*/node_modules/opencode-ai/bin/.opencode", "/usr/local/bin/runc", "*/node_modules/@kilocode/cli/bin/.kilo",
    "*/node_modules/@anthropic-ai/claude-code/bin/*", "/home/*/.local/share/fnm/node-versions/*/installation/lib/node_modules/opencode-ai/bin/.opencode",
    "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode", "/usr/local/bin/runc", "/.init",
    "/tmp/newroot/var/lib/docker/overlay2/*/rootfs/dev/.buildkit_qemu_emulator"
  ) or
  process.executable like "/var/lib/containers/storage/overlay/nix/store/*/bin/.claude-wrapped" or
  process.parent.args in ("/usr/bin/crun", "lxc-attach") or
  process.args == "lxc-attach" or
  (process.args == "datadog-ipc-helper" and process.args == "ddog_daemon_entry_point") or
  (
    process.parent.executable in ("/usr/local/bin/runc", "/.init") and
    process.command_line like ("/.init bash -lc set -euo pipefail*DAGGER_STEP=*", "bash -lc set -euo pipefail*pipefail*DAGGER_STEP=*")
  )
)