Potential Process Masquerading via Exec

process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
process.args == "-c" and process.command_line : "* exec -a *" and not (
  process.executable like ("/nix/store/*", "/tmp/newroot/*") or
  process.parent.executable in (
    "/opt/warpdotdev/warp-terminal/warp", "/opt/sp/serverpilot/stats/bin/sp-stats", "/bin/bcompare", "/bin/su",
    "/usr/NX/bin/nxnode.bin", "/usr/bin/gnome-shell", "/var/lib/dpkg/info/udev.postinst", "/usr/bin/bcompare", 
    "/usr/bin/su", "/usr/bin/claude-bin"
  ) or
  process.parent.executable like (
    "/home/*/.local/share/claude/*", "/home/*/.local/bin/klaude", "/usr/local/*/claude-bin",
    "/home/*/.claude/remote/ccd-cli/*", "/home/*/.claude/remote/ccd-cli", "/claude-cli/versions/*",
    "/usr/scratch/*/git/*/atl/src/aitools/claude/claude-bin", "/opt/forticlient/epctrl",
    "/root/.claude/remote/ccd-cli/*", "/root/.local/share/claude/versions/*", "/mnt/fast/*/.local/share/claude/versions/*",
    "/opt/warpdotdev/warp-terminal/warp (deleted)", "/opt/local/share/claude/versions/*",
    "/usr/share/cursor/cursor", "/home/*/.grok/downloads/grok*linux-x86_64", "/home/*/.codex/*/bin/codex"
  ) or
  process.parent.args == "claude" or
  process.parent.name == "claude" or
  process.command_line like (
    "*/tmp/fzf-args*", "/opt/sp/serverpilot/*", "*/opt/forticlientems/*", "*WarpTerminal*", "/bin/bash -c exec -a bash*",
    "/bin/bash -c exec -a sp-agent /opt/sp/serverpilot/agent/bin/sp-agent", """bash -c exec -a "$0" "$@" reboot /usr/sbin/reboot.no-molly-guard""",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/upgradeworker_linux_amd64 -config ./goEMS.conf",
    "bash -c exec -a cubin_gpu_pool_worker sleep *", "bash -c exec -a chroma sleep 7200",
    "bash -c exec -a 'oes-mfa-agent' /usr/bin/node* --enable-source-maps /opt/novell/oes-mfa-agent/app/mfa-agent/main",
    "bash -c exec -a auto_upgrade_fcems /opt/forticlientemstmp/emsworkers_linux_amd64 -worker_name=upgrade -config ./goEMS.conf",
    "/bin/bash -c exec -a /usr/bin/heidisql /usr/share/heidisql/heidisql  > /dev/null 2>&1 /usr/bin/heidisql",
    "/usr/bin/bash -c exec -a ems:uninstall /opt/forticlient/epctrl uninstall",
    "bash -c exec -a \"apt-get update\" /var/cache/apt/cdroms.list",
    "/bin/bash -c exec -a nvsm_apis_mosquitto /usr/sbin/mosquitto -c /etc/nvsm/nvsm-mqtt.config",
    "*SNAPSHOT_FILE=/home/*/.claude/shell-snapshots/snapshot*"
  ) or
  process.working_directory in ("/opt/novell/umc/apps/umc-server", "/opt/novell/umc/apps/oes-rest", "/usr/share/epoptes-client") or 
  process.args in (
    "exec -a sp-monitor /opt/sp/serverpilot/monitor/bin/monitor",
    "exec -a sp-stats /opt/sp/serverpilot/stats/bin/sp-stats",
    "/usr/bin/bcompare", "/usr/lib64/beyondcompare/BCompare"
  ) or
  process.parent.command_line == "runc init" or
  process.command_line == """bash -c exec -a "$0" "$@" shutdown /usr/sbin/shutdown.no-molly-guard -r now""" or
  (process.command_line == "bash -c exec -a '[sleep router failover]' sleep 1" and process.parent.command_line == "/bin/bash /init.sh") or
  process.parent.command_line like "*/.claude/shell-snapshots/snapshot-*"
)