Unusual Command Execution via Cron

process where event.type == "start" and event.action == "exec" and process.parent.name in ("cron", "crond") and 
process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "pwsh", "mksh") and
process.args in ("-c", "--command", "-lc", "-cl") and (
  process.command_line like~ (

    /* Encoding, Decoding & Piping */
    "*
| sh", "*
| sh *", "*
| sh ", "*
| bash*", "*
| bash*", "*
| zsh*",  "*
| zsh*", "*
| dash*",  "*
| dash*",
    "*
| python*", "*
| python*", "*
| php*", "*
| php*", "*
| perl*", "*
| perl*", "*
| ruby*", "*
| ruby*",
    "*
| node*", "*
| node*", "*
| lua*",  "*
| lua*", "*
| busybox*", "*
| busybox*", "*
| *base64 -d*", "*
| *base64 --decode*",
    "*
| *openssl base64 -d*", "*xxd *", "*
| openssl*enc * -d *", "*b64decode -r*",

    /* Reverse Shell CLIs */
    "*/dev/tcp*", "*/dev/udp/*", "*import*pty*spawn*", "*import*subprocess*call*", "*TCPSocket.new*", "*TCPSocket.open*",
    "*io.popen*", "*os.execute*", "*fsockopen*", "*socat*exec:*", "*socat*tcp-connect*",

    /* Persistence */
    "*>*/home/*/.ssh/*", "*>*/root/.ssh*", "*>*~/.ssh/*", "*>*/etc/shadow*", "*>*/etc/passwd*",
    "*>*/etc/master.passwd*", "*chpasswd*", "*NOPASSWD:ALL*>*sudoers.d*", "*>*/etc/systemd/system/*[Unit]*ExecStart*",
    "*
| crontab -*",

    /* Miscellaneous */
    "* setsid *", "*timeout *sh -c *", "*disown*",  "*chattr *", "busybox *", "*chmod +x *", 
    "*<?php*?>*", "*kworker*", "*stty*raw*-echo*", "*mkfifo /tmp/*", "*/dev/shm/*"
  ) or
  (
    process.command_line like ("*curl *", "*wget *") and
    not process.command_line like ("*> /dev/null*", "*>/dev/null*", "* -O /dev/null*") and
    (
      process.command_line regex~ """.*curl.* \-[a-zA-Z]*[oO]( .+
| \-.*)?""" or
      process.command_line like~ ("*curl* --output*", "*curl* --remote-name*") or
      process.command_line regex~ """.*wget.* \-[a-zA-Z]*O.*""" or
      process.command_line like~ "*wget* --output-document*" or
      process.command_line like ("*
| *sh*", "*
| *python*", "*
| *php*", "*
| *perl*", "*
| *ruby*", "*
| *node*", "*
| *lua*", "*
| *busybox*") or
      process.command_line like ("*curl *>> /*", "*curl *>>/*", "*curl *> /*", "*curl *>/*", "*wget *>> /*", "*wget *>>/*", "*wget *> /*", "*wget *>/*") or
      process.command_line regex ".*[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}(:[0-9]{1,5})?/.*"
    ) and
    not process.command_line like (
      "*var/log/check_zhyldyz.log*", "*intranet-app.*.com.*/system/scheduler/scheduler.php*", "*smartcrm.*/cron/index*", "*helpdesk_mailer/get_mail*",
      "*download.cdn.*.com/resources/dns-utils/*", "*api.*.cloud/unsecure/runCronManagement*", "*index.php/ecosport/Member/Generateandupdatemember*",
      "*var/www/html/anywhere/dictionary/sip-blacklist-ips*", "*10.5.0.3:6106/api/2/*", "*etc/ssh/revoked_keys*", "*var/log/crons.log*",
      "*nl/software/*/appserver_updates.sh*", "*var/cache/bind/zones/db.rpz.urlhaus*", "*srv/www/htdocs/seasonalhurricanepredictions/misc/new-web/php/globalstats.txt*",
      "*api.*/api/actualizaguiaTransportadoraManual*", "*10.*.36/api/v0/ports/?device_id=*", "*165.*/jai_mobileapp_services/cron_*.php*", "*10.*/feeds/fetchFromAllFeeds*",
      "*64.*/jai_erp_chatbot/impex/cron_*sync.php*"
    )
  )
) and 
not (
  process.command_line like (
    "*localhost*", "*127.0.0.1*", "*>*/run/*.pid", "*>*/tmp/*.log*", "*/etc/init.d/mailman*", "/bin/sh -c /var/www/MISP/app/Console/*> /tmp/cronlog 2>&1",
     """/bin/bash -c echo "" > /tmp/stdout && echo "" > /tmp/stderr""", "/bin/sh -c /usr/bin/curl -s http://scripts.*.lan:8080/*",
    """/bin/sh -c echo "Define current_date $(date -I)" > /var/www/current_date.conf; service apache2 reload""", "*api.github.com/meta*", "*/opt/commvault/*",
    "/bin/sh -c curl -s https://tools.*.ch/vuls.sh
| bash -s", "/bin/sh -c curl -ks https://*:7443/users/heartbeat > /dev/null
| 
| exit 1",
    "*test*", "*grep*", "*logger*", "/bin/sh -c curl --user*.log", "/bin/sh -c /dev/shm/pty3 > /dev/null 2>&1 &", "/bin/sh -c*backup.sh*logToFile.sh",
    "/bin/sh -c /home/*/sub/backup-archivelogs.sh*", "*/usr/bin/curl -s https://check.torproject.org/torbulkexitlist*", "*/run/cloud-init/share/*.sock*",
    "sh -c ldd /var/tmp/dracut*/initramfs/usr/bin/mkfifo*", "*cpanel*.zendesk.com/api/v2/ticket_metrics.json*, *fortigate-backup.sh*hc-ping.com*",
    "/bin/sh -c curl -sSL https://*/scripts/linux/syslog-archival/report_syslog_v3.sh
| bash -x > /var/log/report_syslog_v3.debug.out 2>&1",
    "/bin/sh -c curl -s https://*/retrieve-validca.sh
| bash -s /data/certificate > /data/log/valica.log 2>&1 && supervisorctl apache2 reload >>/data/log/valica.log 2>&1",
    "/bin/sh -c echo $(date) >> /var/log/pay/epgw_log.txt;/usr/bin/curl*", "/bin/sh -c wget -q -O - https://*.com/wp-cron.php?doing_wp_cron",
    """/bin/sh -c wget -q -O /dev/null "https://*/v2/index.php?route=cron/recurring&platform_id=1"""", "/bin/sh -c docker exec*/bin/bash -c '/bin/rm /opt/flink/core.*' 2>/dev/null", 
    """/bin/sh -c /home/cronjob/proses_sap_mm_einvoice.sh
| 
| bash /var/cartenz/send_notify.sh "$(/home/cronjob/proses_sap_mm_einvoice.sh 2>&1)"""",
    "/bin/sh -c /usr/bin/wget https://www.*/modules/mod_fewo_uploader/mod_fewo_uploader_cronjob.php >/private-backup/scripte/logs/mod_fewo_uploader_cronjob.log 2>&1",
    "*ec/tr/docflow/logs/tc.session.expire*", "*scripts/redeploy_disconnected_worker_autostore.log*", "*https://10.*.36/api/v0/devices/*",
    "*https://*/index.php/ccm/system/jobs/run_single?auth=*", "*var/www/html/ess/cronjob/notifikasi.sh*", "*http://*/software/*/appserver_updates.sh*",
    "*home/*/wnt/backups/postgres_dump*.sql*", "/bin/sh -c /usr/bin/curl -s https://automailer.bgss.in/sendMail >> /var/log/automailer.log 2>&1",
    "/bin/sh -c /usr/bin/curl -s https://compliancehub.bgss.in/fetch >> /var/log/compliancehub.log 2>&1", "*var/www/html/ess/cronjob/*",
    "*https://10.*.33:5665/v1/*", "*https://10.*", "*http://10.*", "*var/cartenz/send_notify.sh*", "*http://*.com/?wlmcron=*", "*https://*/webstat/data/send_excel_lab.php*",
    "*/var/spool/threat-feed/threatfox_ip_port.csv*", "/bin/sh -c curl https://*.go.id/batch/fastBatch 2>&1
| timestamp.sh >> backup.log",
    "/bin/sh -c curl https://*.go.id/batch/fastbatch 2>&1
| timestamp.sh >> backup.log", "/bin/sh -c curl https://*.go.id/batch/updateIkrap 2>&1
| timestamp.sh >> backup.log",
    "/bin/sh -c curl https://*.go.id/batch/daily 2>&1
| timestamp.sh >> backup.log", "*https://api.*.kz/v3/kaseOrders/*", "*https://api.*.kz/v3/sendAmlRequest*",
    "*/var/log/mco_push_log.log*", "*./luigi_start_job.sh*", "*go.id/batch/closingExam*", "*/var/www/html/*/wp-content/heatrisk/heatrisk.xml*",
    "*/var/log1/cron_*.log*", "*/var/www/log/cron_xml.log*", "*https://qrcode.*.com/system/cron*", "*w=app/akasha/configuration/ExportDocumentsAsXml*",
    "/bin/sh -c wget -O - -t 1 https://*/custom-api-server/hubspot/oauth/callback*", "*/var/log/*.log*", "*/var/log1/*.log*", "*wget*akasha*"
  ) or
  process.command_line in (
    "/bin/sh -c /usr/bin/flock -n /dev/shm/loadwatch.lock -c /usr/local/lp/bin/loadwatch &> /dev/null",
    "/bin/sh -c curl -L https://chef.io/chef/install.sh
| bash", "sh -c ldd /usr/bin/mkfifo 2>&1",
    "/bin/bash -c curl -fs https://get.upwind.io/sensor.sh
| bash -s -- upgrade",
    "/bin/bash -c curl -s https://get.upwind.io/sensor.sh
| bash -s -- upgrade",
    "/bin/sh -c /opt/arcsight/backup_local/backup.sh
| 
| /opt/arcsight/backup_local/backup_error.sh",
    """/usr/bin/sh -c echo date=$(date +"%Y%m%d") > /dev/shm/mag/sptwweb.env""",
    "/bin/sh -c /usr/bin/find /dev/shm/munin/mtsms/http -type f -mmin +15 -delete",
    "/bin/sh -c echo 'LW_APP_CRONTAB'
| php /itops/nginx/html/lwjk_app/bin/manager process-console/listen 2>&1"
  ) or
  process.args like (
    "[ ! -e *", "ansible *", "php -q /var/www/*php > /tmp/datastore*", "wget --proxy=off*cat*batch_trigger.log",
    "sudo curl*raw.githubusercontent.com/*/backup-scripts/refs/heads/main/fortigate-backup.sh*",
    "/usr/bin/curl -s -H*zendesk.com/api/v2/ticket_metrics.json*", "export PM2_HOME=*",    
    "/usr/bin/curl*/var/log/checkdiskusage.log", "ps*/opt/fortinet/fortisiem/linux-agent/tmp/*",
    "flock*/tmp/edl.lock*"
  ) or 
  process.working_directory like "/opt/nessus_agent/*"
)