(type:PATH (name:\/etc\/lsb\-release OR name:\/etc\/redhat\-release OR name:\/etc\/issue)) OR (type:EXECVE (a0:uname OR a0:uptime OR a0:lsmod OR a0:hostname OR a0:env)) OR (type:EXECVE a0:grep (a1:vbox* OR a1:vm* OR a1:xen* OR a1:virtio* OR a1:hv*)) OR (type:EXECVE a0:kmod a1:list)