Pluggable Authentication Module (PAM) Version Discovery

process where host.os.type == "linux" and event.type == "start" and
  event.action in ("exec", "exec_event", "start", "ProcessRollup2") and ?process.parent.name != null and
  (
    (process.name in ("dpkg", "dpkg-query") and process.args == "libpam-modules") or
    (process.name == "rpm" and process.args == "pam")
  ) and
not (
  ?process.parent.name in ("dcservice", "inspectorssmplugin") or
  ?process.working_directory in ("/var/ossec", "/opt/msp-agent") or
  ?process.entry_leader.executable in("/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent", "/usr/sbin/ScanAssistant") or
  ?process.parent.executable in (
    "/opt/CyberCNSAgent/cybercnsagent_linux", "/usr/local/manageengine/uems_agent/bin/dcpatchscan",
    "/usr/local/manageengine/uems_agent/bin/dcconfig", "/usr/share/vicarius/topiad",
    "/etc/rc.d/init.d/sshd-chroot", "/var/ossec/bin/wazuh-modulesd",
    "/usr/lib/venv-salt-minion/bin/python.original"
  ) or
  (
    process.executable == "/usr/bin/rpm" and
    ?process.parent.name == "systemd" and
    ?process.env_vars == "LD_LIBRARY_PATH=/usr/lib/venv-salt-minion/lib"
  )
)