Recently Downloaded File Made Executable and Run

sequence by process.parent.entity_id with maxspan=10s
  [file where event.type == "creation" and process.name in ("wget", "curl") and
   file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*")] as event0
  [process where event.type == "start" and event.action == "exec" and process.name == "chmod" and
   process.command_line like~ (
     /* symbolic exec */
     "*+x*", "*+X*", "*=x*", "*=*x*",
     /* setuid/setgid & copy-perms */
     "*u+s*", "*g+s*", "*u=s*", "*g=s*", "*g=u*", "*o=u*",
     /* numeric: 3-digit forms where any position is 1/3/5/7 */
     "*7??*", "*?7?*", "*??7*",
     "*5??*", "*?5?*", "*??5*",
     "*3??*", "*?3?*", "*??3*",
     "*1??*", "*?1?*", "*??1*",
     /* numeric: 4-digit forms (leading special bit), same idea */
     "*?7??*", "*?5??*", "*?3??*", "*?1??*"
  ) and
  process.args_count >= 2 and
  stringcontains(process.command_line, event0.file.name) and
  not (
    process.command_line like~ ("*-h*","*--help*","*-V*","*--version*") or
    process.parent.command_line like "*/.claude/shell-snapshots/snapshot-*"
  )]
  [process where event.type == "start" and event.action == "exec" and startswith~(process.executable, event0.file.path) and
   not (
     process.parent.executable == "/usr/local/bin/check_idle.sh" or
     process.executable like (
       "/var/lib/docker/*", "/tmp/tmp.*/rustup-init", "/tmp/cis-diagnose-rc-amd64", "/tmp/tmp.*/juliainstaller",
       "/etc/actions-runner-*", "/builds/*/snyk", "/tmp/mpm", "/tmp/coder.*/coder", "/tmp/helm"
     ) or
     (process.executable like "/tmp/teleport-*/install.sh" and process.args == "/usr/bin/env" and process.working_directory like "/tmp/teleport-*") or
     (process.executable == "/tmp/garage" and process.parent.args == "/garage-init") or
     process.working_directory like "/var/lib/waagent/*" or
     process.entry_leader.executable : ("/usr/lib/venv-salt-minion/bin/python.original", "/var/ossec/bin/wazuh-modulesd") or
     (
       process.parent.executable == "/tmp/sca_security.sh" and
       process.executable like "/tmp/*_security_check.sh" and
       process.working_directory == "/var/ossec"
     )
   )]