Unusual Preload Environment Variable Process Execution

event.category:process and host.os.type:linux and event.type:start and event.action:exec and process.env_vars:* and
not (
  process.parent.executable:(/snap/* or "/opt/infraonagent/infraonwindowsagent" or "/worker/Capa/capa") or
  process.parent.name:"cmk-update-agent"
)