Suspicious Python Command Execution

process where event.type == "start" and event.action == "exec" and process.name like "python*" and
process.executable like ("/bin/python*", "/usr/bin/python*", "/usr/local/bin/python*") and
process.args == "-c" and (
  (
    process.command_line like~ ("*import *os;*", "*import *os,*", "*import *pty;*",  "*import *pty,*") and
    process.command_line like~ ("*os.system*", "*os.setuid*", "*os.dup2*", "*pty*", "*os.popen(*")
  ) or
  (
    process.command_line like~ ("*import *socket;*", "*import *socket,*") and
    process.command_line like~ ("*.connect(*", "*os.getenv*", "*os.dup2*", "*socket.socket(*", "*.bind(*") and
    process.command_line like~ "*/bin/*sh*"
  ) or
  (
    process.command_line like~ ("*import *subprocess*;", "*import *subprocess,*") and
    process.command_line like~ "*subprocess.call*"
  ) or
  (
    process.command_line like~ ("*base64*", "*binascii*", "*zlib*", "*gzip*", "*bz2*", "*lzma*", "*marshal.loads(*", "*pickle.loads(*") and
    process.command_line like~ ("*exec(*", "*eval(*")
  ) or
  (
    process.command_line like~ "*import *wave*" and
    process.command_line like~ "*wave.open*" and 
    process.command_line like~ "*readframes*" and 
    process.command_line like~ ("*exec(*", "*eval(*")
  )
) and process.working_directory like (
  "/var/www/*", "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*"
) and not (
  process.parent.args in ("pip", "install", "--pgo", "/tmp/portage/bin/pid-ns-init", "/dockerstartup/custom_startup.sh") or
  process.parent.args like "/home/*/bin/join-zoom.sh" or
  process.parent.name in ("pip", "pytest", "pip3", "sudo", "sshd", "teleport") or
  process.executable like~ ("/var/lib/docker/*", "/tmp/plz_sandbox/*") or
  process.command_line like (
    "/usr/local/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
    "/usr/bin/python* -u -c import sys;exec(eval(sys.stdin.readline()))",
    "python -c import socket s = socket.socket(socket.AF_INET) s.bind(('127.0.0.1', 0)) _, listen_port = s.getsockname() s.close() print(listen_port)",
    "*sqlite*", "*postgres*", "python -c import sys;import base64;sys.stdout.write('@Main\n');exec(base64.b64decode(sys.stdin.readline().rstrip()))#ZeroNetworks",
    """/usr/bin/python3 -c from tkinter import Tcl; print(Tcl().eval("info*"))""",
    "python3*os.system*echo test*", "python3 -c import pymysql*",
    "python3 -c import socket; s=socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('0', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('0.0.0.0', 0)); print(s.getsockname()[1]); s.close()",
    "python3 -c import socket; s=socket.socket(); s.bind(('localhost', 0)); print(s.getsockname()[1]); s.close()",
    "import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
    "import sys;sys.path=[p for p in sys.path if p];import binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64(*",
    "*Thomas Nagy*", "*/tmp/claude-*",
    "/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  process.parent.executable like~ (
    "/var/lib/amazon/ssm/*", "/var/anaconda3/envs/*", "/tmp/plz_sandbox/test", "/usr/bin/cockpit-bridge",
    "/pro/bin/sys/dbutils/dbaValidateOsUserCredentials.sh", "/usr/sbin/lxc", "/sbin/lxc", "/data/flash/Linux_for_Tegra/flash.sh",
    "/usr/bin/ansible-playbook", "/usr/local/bin/teleport", "/usr/local/bin/odoo-helper", "/home/*/bin/join-zoom.sh",
    "/usr/lib/openssh/sshd-session", "/usr/libexec/openssh/sshd-session", "/usr/sbin/lxd", "/usr/sbin/tailscaled", "/home/*/.local/bin/kiro-cli-chat"
  ) or
  process.args like~ """import zlib,base64; exec(zlib.decompress(base64.b64decode(b"eJxlU01v2zAMPUe/QvClEqYZTb*""" or
  process.working_directory like~ (
    "/data/jenkins/.local/share/containers/storage/overlay/*", "/var/run/cloudera-scm-agent/*", "/tmp/pip-req-build*",
    "/tmp/pip-resolve-*", "/build/source", "/tmp/pip-install-*", "/opt/airflow", "/tmp/pip-wheel-*", "/tmp/pip-download-*",
    "/tmp/plz_sandbox", "/builds/*", "/scratch/*", "/tmp/cmdickens/easybuild/*", "/tmp/thangha/easybuild*",
    "/tmp/baum/easybuild/*", "/tmp/zenix-flashing/*", "/opt/ansible*", "/pro/bin/sys/monitor", "/home/jenkins/workspace/*",
    "/var/tmp/portage/*", "/tmp/build/*/ansible", "/root/thg-intelligence", "/home/*/*/*/*", "/root/airflow"
  ) or
  process.parent.command_line like~ (
    "/nix/store/*pytest*", "*/home/*/.claude/shell-snapshots/*", "*vault/core/test_hub/resources/events_checksum_monitor/bucket/verifier_test.go*",
    "*__CURSOR_SANDBOX_ENV_RESTORE*"
  ) or
  process.parent.command_line in ("/bin/bash /docker-entrypoint.sh worker", "/bin/bash /docker-entrypoint.sh") or
  (process.parent.args == "/usr/sbin/lxc" and process.parent.args in ("list", "info", "version")) or
  (process.working_directory like "/tmp/tmp.*" and process.command_line == "python3 -c import socket; s = socket.socket(); s.bind(('', 0)); print(s.getsockname()[1]); s.close()") or
  (
    process.parent.executable == "/usr/libexec/openssh/sshd-session" and
    process.command_line like "/usr/bin/python* -c import sys;sys.path=[p for p in sys.path if p];import binascii,os,select,zlib;exec(zlib.decompress(binascii.a2b_base64(*"
  ) or
  (
    process.executable in ("/bin/python2", "/usr/bin/python2") and
    process.command_line like (
      "*causixenqueuer/firefoot/config.json*", "*s3loguploader.yml*", "*MUM1_AWS_ACCESS_KEY_ID*", "*/etc/init/ahn.conf*", "*AWS_SECRET_ACCESS_KEY_SGP1*"
    )
  ) or
  (
    process.parent.executable like "*/.codex/packages/standalone/releases/*/bin/codex" or
    process.parent.command_line like (
      "codex-linux-sandbox --sandbox-policy-cwd *",
      "*_bgpids_file=/tmp/gemini-shell-*"
    )
  )
)