(type:EXECVE a0:arecord a1:\-vv a2:\-fdat) OR (type:SYSCALL exe:\/ecasound SYSCALL:memfd_create)