Potential Mining Pool Command Detection

process where event.type == "start" and event.action == "exec" and process.parent.executable != null and (
  process.name like (
    "telnet.netkit", "ping", "telnet", "xmrig", "dash", "bash", "sh", "zsh", "ash", "fish", "ksh", "tcsh",
    "csh", "nohup", "pgrep", "python*", "perl*", "ruby*", "php*", "lua*", "sed", "pkill", "docker", "dig",
    "nslookup", "inetutils-telnet", "nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd",
    "nc.traditional", "curl", "wget", "sudo", "grep", ".*"
  ) or
  process.executable like (
    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/boot/*", "./*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
    "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*"
  )
) and
process.command_line like (
  "*cnpool.cc*", "*lindon-pool.win*", "*supportxmr.com*", "*comgandalph3000.com*", "*minergate.com*",
  "*fjhan.club*", "*emercoin.com*", "*poolto.be*", "*520fjh.org*", "*xmrpool.xyz*", "*simka.pw*", "*noobxmr.com*",
  "*miner.rocks*", "*minerpool.pw*", "*minemonero.gq*", "*usxmrpool.com*", "*moneroocean.stream*", "*mypool.online*",
  "*xmrpool.de*", "*emergate.net*", "*ip28.net*", "*mine.bz*", "*dwarfpool.com*", "*xmrig.com*", "*koto-pool.work*",
  "*monerorx.com*", "*zarabotaibitok.ru*", "*mining-help.ru*", "*mine2gether.com*", "*moneropool.com*", "*viaxmr.com*",
  "*minerrocks.com*", "*miningpoolhub.com*", "*cortins.tk*", "*pooldd.com*", "*unmineable.com*", "*f2pool.com*",
  "*graef.in*", "*nanopool.org*", "*myxmr.pw*", "*ratchetmining.com*", "*cryptmonero.com*", "*xmrminer.cc*",
  "*riefly.id*", "*iwanttoearn.money*", "*herominers.com*", "*xmrpool.me*", "*miners.pro*", "*luckpool.net*",
  "*twotouchauthentication.online*", "*hashvault.pro*", "*4i7i.com*", "*miningocean.org*", "*2miners.com*",
  "*xmrpool.eu*", "*monerpool.org*", "*joulecoin.org*", "*suprnova.cc*", "*monerocean.stream*", "*bohemianpool.com*", 
  "*crypto-pool.fr*", "*xmr.pt*", "*alimabi.cn*", "*teracycle.net*", "*monerogb.com*", "*armornetwork.org*",
  "*emercoin.net*", "*poolmining.org*", "*minexmr.cn*", "*moriaxmr.com*", "*ethereumpool.co*", "*minercircle.com*",
  "*prohash.net*", "*zer0day.ru*", "*crypto-pool.info*", "*pool.support*", "*siamining.com*", "*5b6b7b.ru*",
  "*c3pool.com*", "*somec.cc*", "*hellominer.com*", "*usa-138.com*", "*mixpools.org*", "*xmrpool.net*",
  "*moneroworld.com*", "*minerxmr.ru*", "*d5pool.us*", "*hashcity.org*", "*hex7e4.ru*", "*zpool.ca*", "*minexmr.com*",
  "*monerohash.com*", "*multipool.us*", "*moneropool.nl*", "*nbminer.com*", "*ppxxmr.com*", "*xmrfast.com*",
  "*webhop.net*", "*ethpool.org*", "*slushpool.com*", "*antpool.com*", "*nicehash.com*", "*nicehash.net*",
  "*zergpool.com*", "*mining-dutch.nl*", "*blockmasters.co*", "*bsod.pw*", "*fairpool.xyz*", "*miningrigrentals.com*",
  "*hashing24.com*", "*ethermine.org*", "*flexpool.io*", "*hiveon.net*", "*sparkpool.com*", "*2miners.org*",
  "*poolin.com*", "*viabtc.com*", "*f2pool.org*", "*coinhive.com*", "*cryptoloot.pro*", "*webmine.cz*",
  "*minero.cc*", "*monerohash.org*", "*monerohash.net*", "*moneropool.ru*", "*moneroocean.stream*", "*rx.unmineable.com*"
) and not (
  process.parent.name in ("sendmail", "postfix-local", "check-quota", "zmcontrol", "find", "timeout", "php") or
  process.name in ("timeout", "host", "ptxas") or
  process.command_line like ("*zpool.cache*", "*app/jobs/ant-sec_observe-income.py*") or
  process.parent.args == "/scripts/run_certbot.sh" or
  process.parent.command_line == "runc init" or
  (process.parent.command_line == "/bin/bash /usr/local/bin/soc_guard.sh" and process.executable == "/usr/bin/grep") or
  (process.parent.name like "php*" and process.command_line like "*/var/tools/koalaping/bin/ping.php*") or
  (
    process.parent.command_line == "/bin/bash /root/nicehash/nicehash_api.sh /main/api/v2/mining/algo/stats" and
    process.command_line like "python3 /root/nicehash/nicehash.py -b https://api2.nicehash.com -o * -m GET -p /main/api/v2/mining/algo/stats"
  )
)