Data Encrypted and Archived

sequence by process.parent.entity_id with maxspan=10s
  [process where event.type == "start" and event.action in ("exec", "start") and process.name : ("openssl", "openssl.exe") and
  process.args : ("enc", "pkeyutl", "cms", "smime")]
  [process where event.type == "start" and event.action in ("exec", "start") and
  process.name : (
    "tar", "zip", "gzip", "xz", "7z", "7za", "7zr", "bzip2", "zstd",
    "tar.exe", "zip.exe", "gzip.exe", "7z.exe", "7za.exe", "7zr.exe", "bzip2.exe", "zstd.exe", "zstd64.exe"
  ) and
  not (
    process.parent.args in (
      "/opt/rudder/share/commands/agent-run", "/usr/sbin/backup_orbini", "/usr/local/bin/mariadb-backup.sh",
      "/usr/local/bin/drupal-per-site-backup.sh"
    ) or
    process.parent.args like "mariabackup*db_backup*" or
    process.parent.command_line like (
      "*mysqldump*localhost*/storage/backup*", "*/etc/pve*prox_backup*", "*/home/*/.local/bin/authd*"
    ) or
    process.parent.executable == "/opt/rudder/bin/rudder" or
    process.working_directory like "/mnt/vstk/queue/*" or
    process.args like "/var/rudder/tmp/reports/*" or
    (process.name == "tar" and process.working_directory like "/u/sysdat/*") or
    (
      (process.parent.executable == "/home/backup/backup.sh" or process.parent.args == "/backup/backup_temp") and
      process.working_directory like "/storage/*"
    )
  )]