Hi everyone. I'm trying to make meaningful indicator of compromise for bpf_process_events originating from unprivileged locations like

/tmp*, /var/tmp/*, /dev/shm/*

. Would following query make any sense ?

SELECT A.pid AS child_process_pid, A.path AS child_process_path, A.parent AS parent_pid, B.pid AS parent_own_pid, B.path AS parent_own_path, FROM bpf_process_events A, bpf_process_events B WHERE parent_pid = parent_own_pid AND child_process_path LIKE '/tmp/%' OR child_process_path LIKE '/dev/shm%' OR child_process_path LIKE '/var/tmp%';