Remote SSH Login Enabled via systemsetup Command

process where host.os.type == "macos" and event.type in ("start", "process_started") and
(
  (
    process.name == "systemsetup" and
    process.args like~ "-setremotelogin" and
    process.args like~ "on"
  ) or
  (
    process.name == "launchctl" and
    process.args in ("load", "bootstrap") and
    (
      process.command_line like~ "*/System/Library/LaunchDaemons/ssh.plist*" or
      process.command_line like~ "*com.openssh.sshd*"
    )
  )
) and
process.parent.executable != null and
not process.parent.executable like ("/usr/local/jamf/bin/jamf", "/usr/libexec/xpcproxy", "/usr/bin/sudo")