Potential Coin Miner Execution via Shell

process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and (
  (
    process.command_line like ("*-a*", "*--algo*", "*--coin*") and process.command_line like (
      "*monero*", "*arqma*", "* dero *", "*rx/graft*", "*cn/upx2*", "*cn/1*", "*cn-lite/1*", "*cn-lite/0*", "*cn/0*",
      "*argon2/chukwav2*", "*cn/ccx*", "*kawpow*", "*rx/keva*", "*cn-pico/tlo*", "*rx/sfx*", "*rx/arq*", "*rx/0*",
      "*argon2/chukwa*", "*argon2/ninja*", "*rx/wow*", "*cn/fast*", "*cn/rwz*", "*cn/zls*", "*cn/double*", "*cn/r*",
      "*cn-pico*", "*cn/half*", "*cn/2*", "*cn/xao*", "*cn/rto*", "*cn-heavy/tube*", "*cn-heavy/xhv*", "*cn-heavy/0*"
    )
  ) or process.command_line like ("*stratum+tcp://*", "*stratum2+tcp://*", "*--nicehash*") 
) and not (
  process.parent.name like (
    "find", "python3", "httpd", "sshd", "php*", "sudo", "ruby", "nvim", "vim", "make", "schroot", "vimdiff", "sbuild", "ninja"
  ) or
  process.parent.executable in (
    "/opt/cron/registry-sync/ru/syncRegistryByReport.pl",  "/usr/bin/gvimdiff", "/usr/bin/ninja-reference",
    "/usr/bin/sw-engine", "/usr/local/bin/teleport", "/usr/share/dotnet/dotnet", "/usr/libexec/openssh/sshd-session"
  ) or
  process.parent.executable like ("/tmp/baum/easybuild/*", "/home/*/.vscode-server/extensions/*/resources/native-binary/claude") or
  process.command_line like ("*openssl*", "*--display-charset*", "sh -c aws s3 cp*") or
  process.parent.args in ("/usr/bin/crun", "/usr/local/bin/claude") or
  (
    process.parent.executable like "/home/*/.local/share/claude/versions/*" and
    process.command_line like "/bin/bash -c source /home/*/.claude/shell-snapshots/snapshot-*"
  )
)