(type:EXECVE (a0:mkdir OR a0:nano OR a0:touch OR a0:vi OR a0:vim)) (a1:(^|\\/)\\.[^.\\/] OR a2:(^|\\/)\\.[^.\\/])