Potential Reverse Shell Activity via Terminal

process where event.action == "exec" and process.name in ("sh", "bash", "zsh", "dash", "zmodload") and
process.command_line like~ ("*/dev/tcp/*", "*/dev/udp/*", "*zsh/net/tcp*", "*zsh/net/udp*") and 
process.parent.executable != null and 
not (
  process.parent.name == "timeout" or
  process.command_line like~ (
    "*/dev/tcp/sirh_db/*", "*/dev/tcp/itom-vault/8200*", "*/dev/tcp/remoteiot.com/*", "*dev/tcp/elk.stag.one/*",
    "*dev/tcp/kafka/*", "*/dev/tcp/$0/$1*", "*/dev/tcp/::1/*", "*/dev/tcp/livelog.default.svc.cluster.local*",
    "*/dev/tcp/db.default.svc.cluster.local*", "*/dev/tcp/127.*", "*/dev/udp/127.*", "*/dev/tcp/localhost/*",
    "*/dev/tcp/splunk*telconet.net/*",
    "bash -c timeout 2 bash -c 'echo > /dev/tcp/kafka*' 2>/dev/null && echo 'Connected'
| 
| echo 'Failed'", 
    "*/dev/tcp/*echo*", "*.claude/shell-snapshots/*echo*"
  ) or
  process.parent.command_line in ("runc init", "/usr/bin/python /opt/oracle/dcs/exacd_netchk/exacd_netchk.py") or
  process.parent.args in ("/usr/local/bin/runc", "/opt/bitnami/scripts/keycloak/setup.sh", "/usr/bin/testssl.sh") or
  process.working_directory == "/opt/rapid7/ir_agent/components/endpoint_broker/common" or
  process.parent.executable like (
    "/opt/cdf/data/containerd/*", "/usr/bin/consul", "/usr/sbin/sshd", "/usr/bin/runc", "/usr/share/cursor/cursor", 
    "/home/*/.nvm/versions/node/*/bin/node", "/home/*/t38-k8s/*/k8sts", "/home/*/.opencode/bin/opencode",
    "/usr/bin/gnome-shell", "/usr/bin/coreutils", "/home/*/.local/bin/kiro-cli-chat",
    "/opt/Tychon/Endpoint/bin/TychonCoreService", "/usr/local/bin/teleport", "/opt/teleport/system/bin/teleport",
    "/usr/bin/claude-bin", "/usr/local/share/npm-global/lib/node_modules/opencode-ai/bin/.opencode",
    "/home/*/.local/share/claude/versions/*", "/home/linuxbrew/.linuxbrew/Caskroom/codex/*/codex-x86_64-unknown-linux-musl",
    "/opt/homebrew/Cellar/coreutils/*/bin/gtimeout", "/usr/local/Cellar/coreutils/*/bin/gtimeout"
  ) or
  (process.parent.name == "sudo" and process.parent.command_line like "*teleport-installer*") or
  (
    process.args like "/dev/tcp/nomzk-client-svc/*" and
    process.executable like "/opt/cdf/data/containerd/state/io.containerd.runtime.v2.task/k8s.io/*/rootfs/usr/bin/bash"
  ) or
  (process.args like "-l source*/tmp/claude*" and process.parent.name == "node") or
  (process.working_directory == "/opt/Tychon/Endpoint/bin" and process.parent.command_line == "/usr/bin/bash -s") or
  (process.command_line like "*claude*" and process.parent.command_line == "claude")
)