Potential Python Stealer

sequence by process.entity_id with maxspan=30s
[process where event.type == "start" and event.action == "exec" and
  process.name like~ "python*" and process.args_count == 2 and 
  process.args like ("/Users/Shared/*", 
                     "/tmp/*", 
                     "/private/tmp/*", 
                     "/var/tmp/*",
                     "/var/root/*",
                     "/private/var/root/*", 
                     "/private/var/tmp/*")]
[file where event.action == "open"] as event0
[file where event.action == "open" and not file.path == event0.file.path] as event1
[file where event.action == "open" and not file.path == event1.file.path and not file.path == event0.file.path]