System Binary Copied or Moved

process where event.type == "start" and event.action == "exec" and process.name in ("cp", "mv") and 
process.args in (
    "/bin/sh", "/usr/bin/sh", "/usr/local/bin/sh",
    "/bin/bash", "/usr/bin/bash", "/usr/local/bin/bash",
    "/bin/dash", "/usr/bin/dash", "/usr/local/bin/dash",
    "/bin/zsh", "/usr/bin/zsh", "/usr/local/bin/zsh",
    "/bin/ksh", "/usr/bin/ksh", "/usr/local/bin/ksh",
    "/bin/nc", "/usr/bin/nc", "/usr/local/bin/nc",
    "/bin/netcat", "/usr/bin/netcat", "/usr/local/bin/netcat",
    "/bin/ncat", "/usr/bin/ncat", "/usr/local/bin/ncat",
    "/bin/nc.traditional", "/usr/bin/nc.traditional", "/usr/local/bin/nc.traditional",
    "/bin/nc.openbsd", "/usr/bin/nc.openbsd", "/usr/local/bin/nc.openbsd",
    "/bin/netcat.openbsd", "/usr/bin/netcat.openbsd", "/usr/local/bin/netcat.openbsd",
    "/bin/netcat.traditional", "/usr/bin/netcat.traditional", "/usr/local/bin/netcat.traditional",
    "/bin/socat", "/usr/bin/socat", "/usr/local/bin/socat",
    "/bin/nmap", "/usr/bin/nmap", "/usr/local/bin/nmap",
    "/bin/telnet", "/usr/bin/telnet", "/usr/local/bin/telnet",
    "/bin/curl", "/usr/bin/curl", "/usr/local/bin/curl",
    "/bin/wget", "/usr/bin/wget", "/usr/local/bin/wget",
    "/bin/python", "/usr/bin/python", "/usr/local/bin/python",
    "/bin/python3", "/usr/bin/python3", "/usr/local/bin/python3",
    "/bin/perl", "/usr/bin/perl", "/usr/local/bin/perl",
    "/bin/ruby", "/usr/bin/ruby", "/usr/local/bin/ruby",
    "/bin/php", "/usr/bin/php", "/usr/local/bin/php",
    "/bin/awk", "/usr/bin/awk", "/usr/local/bin/awk",
    "/bin/busybox", "/usr/bin/busybox", "/usr/local/bin/busybox",
    "/bin/find", "/usr/bin/find", "/usr/local/bin/find",
    "/bin/xargs", "/usr/bin/xargs", "/usr/local/bin/xargs",
    "/bin/env", "/usr/bin/env", "/usr/local/bin/env",
    "/bin/cut", "/usr/bin/cut", "/usr/local/bin/cut",
    "/bin/tee", "/usr/bin/tee", "/usr/local/bin/tee",
    "/bin/ssh", "/usr/bin/ssh", "/usr/local/bin/ssh",
    "/bin/sshd", "/usr/bin/sshd", "/usr/local/bin/sshd",
    "/bin/scp", "/usr/bin/scp", "/usr/local/bin/scp",
    "/bin/ftp", "/usr/bin/ftp", "/usr/local/bin/ftp",
    "/bin/tftp", "/usr/bin/tftp", "/usr/local/bin/tftp",
    "/bin/kubectl", "/usr/bin/kubectl", "/usr/local/bin/kubectl",
    "/bin/crictl", "/usr/bin/crictl", "/usr/local/bin/crictl",
    "/bin/dockerd", "/usr/bin/dockerd", "/usr/local/bin/dockerd",
    "/bin/docker", "/usr/bin/docker", "/usr/local/bin/docker",
    "/bin/containerd", "/usr/bin/containerd", "/usr/local/bin/containerd"
  ) and process.args_count >= 3 and not (
  process.parent.executable like (
    "/usr/lib/dracut/dracut-install", "/usr/bin/make", "/bin/make", "/usr/share/initramfs-tools/hooks/*", "/var/lib/dpkg/info/*",
    "/usr/local/bin/sigostclsh8.6", "/usr/lib/usrmerge/convert-usrmerge", "/usr/sbin/rear", "/usr/bin/byobu-status", "/sbin/rear",
    "/usr/bin/find", "/tmp/newroot/nix/store/*/activate", "/nix/store/*/activate", "/var/lib/containers/storage/overlay/nix/store/*/activate",
    "/var/lib/dpkg/tmp.ci/preinst", "/usr/sbin/nv-update-initrd", "/sbin/dracut", "/opt/SIGOS/*", "/tmp/newroot/usr/lib/dracut/dracut-install",
    "/usr/libexec/flatpak-session-helper", "/usr/sbin/mkinitramfs", "/var/tmp/portage/*/libtool", "/tmp/newroot/usr/bin/make"
  ) or
  process.working_directory like (
    "/etc/localtime/var/lib/rancher", "/run/k3s/containerd/*", "/var/lib/docker/*", "/var/lib/rancher", "/var/tmp/portage/*"
  ) or
  process.args like ("/var/tmp/dracut.*/initramfs/*", "/var/tmp/mkinitramfs_*", "/opt/jail/driver-jail/*") or
  process.parent.args like (
    "/var/tmp/rpm-tmp*", "/usr/sbin/rear", "/usr/lib/usrmerge/convert-usrmerge", "/usr/share/initramfs-tools/hooks/zz-busybox",
    "./libtool", "/var/lib/dpkg/info/dash.postinst", "*./libtool*", "/usr/bin/mkinitcpio", "/sbin/rear"
  ) or
  process.command_line in (
    "mv kubectl /usr/bin/kubectl", "mv ./kubectl /usr/bin/kubectl", "cp kubectl /usr/local/bin/kubectl",
    "mv kubectl /usr/local/bin/kubectl", "mv ./kubectl /usr/local/bin/kubectl",
    "/usr/bin/coreutils --coreutils-prog-shebang=cp /usr/bin/cp /usr/bin/sh /tmp"
  ) or
  (process.parent.command_line like "/nix/store/*" and process.command_line == "mv /bin/.sh.tmp /bin/sh") or
  (process.parent.name == "shtool" and process.command_line == "mv /usr/local/bin/#INST@*# /usr/local/bin/php") or
  (
    process.args like "./curl.leap*.x86_64" and
    process.working_directory like "/opt/SIGOS/sitedata/exec/*"
  ) or
  process.parent.command_line == "/usr/bin/runc init"
)