config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 ((action_process_image_path contains "/wget" and 
 action_process_image_command_line ~= "https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" and 
 action_process_image_command_line contains "--no-check-certificate" and 
 action_process_image_command_line contains ".tar") and 
 (not 
 (action_process_image_command_line in ("*https://10.*", "*https://192.168.*", "*https://172.16.*", "*https://172.17.*", "*https://172.18.*", "*https://172.19.*", "*https://172.20.*", "*https://172.21.*", "*https://172.22.*", "*https://172.23.*", "*https://172.24.*", "*https://172.25.*", "*https://172.26.*", "*https://172.27.*", "*https://172.28.*", "*https://172.29.*", "*https://172.30.*", "*https://172.31.*", "*https://127.*", "*https://169.254.*")))))