type="EXECVE" a1 IN ("*/dev/tcp/*", "*/dev/udp/*") OR a2 IN ("*/dev/tcp/*", "*/dev/udp/*") OR a3 IN ("*/dev/tcp/*", "*/dev/udp/*")
