Polkit Version Discovery

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "process_started", "executed") and (
  (process.name == "dnf" and process.args == "dnf" and process.args == "info" and process.args == "polkit") or
  (process.name == "rpm" and process.args == "polkit") or
  (process.name == "apt" and process.args == "show" and process.args == "policykit-1") or
  (process.name == "pkaction" and process.args == "--version")
) and
not (
  ?process.working_directory in ("/opt/msp-agent", "/opt/CyberCNSAgent") or
  ?process.parent.executable like ("/usr/local/cpanel/3rdparty/perl/*/bin/perl", "/usr/share/vicarius/topiad") or
  ?process.entry_leader.executable in ("/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent", "/sf/edr/agent/bin/edr_monitor") or
  (
    ?process.parent.args == "/usr/lib/venv-salt-minion/bin/python.original" and
    ?process.parent.args == "/usr/lib/venv-salt-minion/bin/salt-minion"
  )
)