Unusual Exim4 Child Process

host.os.type:linux and event.type:start and event.action:exec and process.parent.name:exim4 and
not process.name:(
  exim4 or start-stop-daemon or run-parts or systemctl or update-exim4.conf or install or plymouth or
  readlink or grep or stat or cmake or gcc or cppcheck or sort or sshd
)