Hidden Payload Executed via Scheduled Job

process where event.type == "start" and event.action == "exec" and (
  (process.parent.name in ("cron", "crond") and process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
   process.args == "-c" and process.args like "*/.*" and not process.args like ("*/.*/*", "*/.*;*")) or
  (process.parent.name == "systemd" and process.args like "*/.*" and process.args_count == 1)
) and not (
  process.command_line in (
    "/bin/sh -c /bin/bash /root/rotate.sh rotate /root/.vault-token",
    "/bin/sh -c crontab -l > $HOME/.crontab",
    "/bin/sh -c autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/.dbbackup.sh",
    "/bin/sh -c bash /root/.stafftimerDatabase.sh",
    "/bin/sh -c bash /root/.db-backup.sh",
    "/bin/bash -c chown root /tmp/.flexlm*",
    "/bin/sh -c crontab -l > $HOME/.crontab.bak",
    "/bin/sh -c /bin/...",
    "/bin/sh -c crontab -l > ~keystone/.crontab.$MAILTAG.keystone",
    "/bin/sh -c /usr/local/bin/autorestic -c /root/.autorestic.yml --ci cron",
    "/bin/sh -c /root/bin/getssl -a -q -w /root/.getssl-acme.sectigo.com",
    "/bin/sh -c /webmail/tools/alluser.pl > /webmail/modules/ad_sync/etc/.always_keep.list",
    "/bin/sh -c bash /root/.pf-new-vpn-ssl-check.sh",
    "/bin/sh -c /bin/bash $HOME/.backup.sh",
    "/bin/sh -c /bin/mysql_tzinfo_to_sql /usr/share/zoneinfo/
| /bin/mysql --defaults-file=/root/.my.cnf mysql",
    "/bin/sh -c /bin/echo -n >/data/EXPORT/.approved",
    "/bin/sh -c source ~/.bashrc",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl", "/bin/sh -c mysqlcheck --defaults-file=/root/.my.cnf -o misp",
    "/bin/sh -c /usr/local/bin/getssl -a -q -w /home/acme/.getssl-lets-encrypt"
  ) or
  process.command_line like (
    "*/home/*/.*.*", "*/opt/invgate/insight-agent/*", "*ansible*", "/bin/sh -c /backup/store_Weight_LABEL/.create_site.sh*",
    "/bin/sh -c /backup/mktphotos/.main*.sh", "/bin/bash -c unset*/var/.cagefs'", "/bin/sh -c *autorestic*", "*/opt/export-ecs-ip/ecs-ip.py*", 
    "/bin/sh -c /usr/local/bin/mettle cache -d /var/cache/mettle *", 
    "/bin/sh -c /opt/tm/mettle/root/mettle cache -d /opt/tm/mettle/root/var/cache/mettle*",
    "/bin/sh -c gssh-agent scp -r *:/mnt/*/common/shared/*/skills_repo/skills ~/.agents"
  ) or
  process.args like (
    "/usr/sbin/tmpwatch*", "/usr/sap/*", "sed*", "*/../*", "cd ~/.unison*", "/usr/sbin/logrotate*",
    "/home/raulsiim/.local/share/JetBrains/Toolbox/apps/intellij-idea-community-edition/bin/idea",
    "/usr/bin/flock*", "export VAULT_ADDR=* VAULT_SKIP_VERIFY=true && /usr/local/bin/vault token renew >> ~/.vault-renewal.log 2>&1"
  ) or
  process.executable like (
    "/opt/eset/eei/bin/*", "/tmp/newroot/tmp/.mount_*", "/tmp/.mount_*", "/opt/gotify/gotify-linux-amd64",
    "/home/*/.local/share/JetBrains/Toolbox/apps/goland/bin/goland", "/home/*/.linuxbrew/opt/etcd/bin/etcd",
    "/tmp/newroot/home/*/.local/share/JetBrains/*", "/home/*/.local/share/caa/caa",
    "/home/*/.local/bin/gitsign-credential-cache",
    "/home/*/.local/share/JetBrains/Toolbox/apps/intellij-idea-ultimate/bin/idea",
    "/home/*/.local/share/JetBrains/*", "/home/*/.local/opt/activitywatch/*",
    "/home/*/.local/bin/claude-oauth-proxy", "/root/.local/openaev-agent-session/openaev-agent",
    "/nix/store/*/bin/.blueman-tray-wrapped", "/var/lib/containers/storage/overlay/nix/store/*/bin/.blueman-tray-wrapped",
    "/home/*/.config/discord/*/Discord"
  ) or
  process.name in ("riptide-agent", "zellij", "gitsign-credential-cache", "jetbrains-toolbox", "goland") or
  process.working_directory == "/var/lib/rabbitmq" or
  (process.working_directory == "/home/oracle" and process.command_line like "/bin/sh -c sh /u01/oradata/*")
)