Suspicious Invocation of Shell through Rsync (via process_creation)

This rule detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is frequently linked with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.