Sleep Execution from Suspicious Process Path

sequence by process.parent.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "exec" and process.parent.executable != null and
  (process.executable like ("/tmp/*", "/var/tmp/*", "/dev/shm/*") or process.name like ".*") and not (
    process.executable like~ (
      "/tmp/newroot/*", "/tmp/JobScheduler-Agent*", "/tmp/petalinux_*", "/tmp/plz_sandbox/third_party/*", "/var/tmp/buildah*",
      "/infanspr/scripts/.root/.infans-daily-server-script", "/tmp/.mount_jetbrap*", "/tmp/snap.rootfs_*", "/tmp/ubuntu-release-upgrader-*",
      "/tmp/tmp.*/.venv/bin/pytest", "/tmp/par-*/castnet_webserver", "/tmp/build/.heroku/node/bin/node",
      "/tmp/.ansible*", "/tmp/*/com.service_now*", "/tmp/*/easybuild/*", "/nix/store/*", "/tmp/tmp.*/ijent",
      "/tmp/*/.venv/bin/python", "/tmp/text_templater_*", "/var/tmp/container*/usr/bin/dpkg", "/tmp/container*/usr/bin/dpkg",
      "/run/systemd/mount-rootfs/nix/store/*", "/tmp/xfs-*/yarn", "/tmp/root/spack*", "/tmp/nix-shell-*/node",
      "/tmp/nix-shell-*/yarn", "/var/tmp/portage/*", "/tmp/.*.ansible/ansible-tmp-*", "/tmp/nsjail.1000.root/usr/bin/sleep",
      "/tmp/usr/bin/*", "/tmp/build/.heroku/node/bin/npm", "/tmp/petalinux/*", "/tmp/tailsampling-*", "/tmp/*/.cursor-server/bin/linux-x64/*/node",
      "/tmp/cursor-server-cache/bin/linux-x64/*/node", "/tmp/*/.vscode-server/code-*", "/tmp/*-cursor-server/bin/linux-x64/*/node",
      "/tmp/.mount_Cursor*/usr/share/cursor/resources/app/node_modules/@vscode/ripgrep/bin/rg", "/tmp/install.dir.*/Linux/resource/jre/lib/jspawnhelper",
      "/tmp/gomod-overlay/merged/golang.org/*/bin/go", "/tmp/tmp.*/amfu/bin/cinsh", "/tmp/nagent_install/nagent-ubuntu22_64/InitialValidate",
      "/tmp/arcane-install*", "/tmp/p11_keepalive.*/p11_signer", "/tmp/iperf3-extract/usr/bin/iperf3", "/tmp/ventoy-install.*/tool/x86_64/vtoycli",
      "/tmp/odindash-build", "/tmp/snap-private-tmp/snap.rootfs_*", "/tmp/CSFFC/*", "*/.vscode-server/bin/*/bin/code-server", "*/.vscode-server/code-*"
    ) or
    process.command_line == "runc init" or
    process.name in ("gcc", "xgcc", "nvim") or
    process.parent.name == "ansible" or
    process.working_directory like (
      "/build", "/tmp/newroot/*", "/tmp/plz_sandbox", "/tmp/.build/*", "/tmp/tmp/bwrap*", "/jenkins/workspace/*",
      "/var/lib/waagent/*", "/tmp/plz_sandbox/*", "/builds/*", "/opt/bmc/bladelogic/RSCD", "/var/lib/one"
    ) or
    process.parent.executable like (
      "/tmp/go-build*", "/tmp/newroot/tmp/.mount*", "/var/lib/containers/*", "/tmp/newroot/usr/bin/ansible-playbook",
      "/usr/bin/ansible-playbook", "/tmp/newroot/*", "/tmp/.mount_cursor*/cursorsandbox", "/usr/local/bin/crush",
      "./usr/bin/podman", "/usr/bin/podman", "/tmp/*/.vscode-server/extensions/openai.chatgpt-*/bin/*/codex-resources/*"
    ) or
    process.parent.args like ("source /home/*/.claude/shell-snapshots/snapshot-bash*", "/var/ossec/bin/wazuh-control") or
    process.parent.command_line like ("*github.com/community-scripts/ProxmoxVE/*", "*/home/*/.claude/shell-snapshots/snapshot*") or
    process.parent.command_line == "bash -c while true; do sleep 1;head -v -n 8 /proc/meminfo; head -v -n 2 /proc/stat /proc/version /proc/uptime /proc/loadavg /proc/sys/fs/file-nr /proc/sys/kernel/hostname; tail -v -n 32 /proc/net/dev;echo '==> /proc/df <==';df -l;echo '==> /proc/who <==';who;echo '==> /proc/end <==';echo '##Moba##'; done" or
    (process.executable == "/tmp/confluent" and process.parent.args like "./ci/e2e/tests/*")
  )]
  [process where event.type == "start" and event.action == "exec" and process.name == "sleep"]