Execution via Electron Child Process Node.js Module

process where event.action == "exec" and
 process.args == "-e" and process.command_line like~ "*require*child_process*" and
 process.command_line like~ "*spawn*" and
 (
   /* Spawning shells with inline commands */
   process.command_line like~ ("*spawn*bash*-c*", "*spawn*sh*-c*", "*spawn*zsh*-c*") or
   /* Spawning curl/wget for download */
   process.command_line like~ ("*spawn*curl*", "*spawn*wget*") or
   /* Spawning osascript */
   process.command_line like~ "*spawn*osascript*" or
   /* Spawning python with inline code */
   process.command_line like~ "*spawn*python*-c*" or
   /* Base64 decode patterns */
   process.command_line like~ "*spawn*base64*" or
   /* Execution from suspicious staging paths */
   process.command_line like~ ("*spawn*/tmp/*", "*spawn*/Users/Shared/*", "*spawn*/private/tmp/*", "*spawn*/var/tmp/*")
 ) and
 not process.executable like
             ("/usr/bin/grep",
              "/Applications/Docker.app/Contents/Resources/bin/docker",
              "/Applications/Docker.app/Contents/Resources/bin/com.docker.cli") and
 not process.Ext.effective_parent.executable like 
    ("/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/Contents/MacOS/claude",
      "/Applications/ChatGPT.app/Contents/MacOS/ChatGPT")