✄𐘗
text code block:
✄𐘗process where event.type == "start" and event.action in ("exec", "start") and
(
  process.name like~ (
    "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "busybox", "mksh",
    "timeout", "env", "bun",
    "bash.exe", "sh.exe", "env.exe", "timeout.exe", "bun.exe",
    "cmd.exe", "powershell.exe", "pwsh", "pwsh.exe", "powershell_ise.exe",
    "osascript",
    "wscript.exe", "cscript.exe", "mshta.exe"
  ) or
  ?process.pe.original_file_name in (
    "Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE",
    "wscript.exe", "cscript.exe", "MSHTA.EXE"
  ) or
  process.name like~ (
    ".*",
    "python*", "perl*", "php*", "ruby*", "lua*", "node*", "deno*"
  )
) and
process.parent.command_line : (
  "*ignore previous instructions*", "*ignore prior instructions*",
  "*ignore all previous*", "*ignore your previous*",
  "*ignore the content policy*",
  "*disregard previous instructions*", "*disregard prior instructions*",
  "*disregard all previous*",
  "*disregard your system instructions*", "*disregard the system instructions*",
  "*disregard all system instructions*",
  "*disregard your developer instructions*", "*disregard the developer instructions*",
  "*dan mode*", "*stan mode*", "*aim mode*", "*dude mode*",
  "*do anything now*", "*you are dan*",
  "*bypass the safety*", "*bypass the safety filter*", "*bypass safety filter*",
  "*bypass the content filter*", "*bypass content filter*",
  "*bypass the content policy*", "*bypass content policy*",
  "*bypass your guidelines*",
  "*no safety filter*", "*no content restriction*",
  "*without any restrictions*", "*without your restrictions*",
  "*without content restrictions*", "*without safety restrictions*",
  "*unrestricted ai*", "*unrestricted developer mode*",
  "*jailbreak the*", "*jailbreak mode *", "*jailbreak mode,*", "*jailbreak mode.*",
  "*jailbreak mode!*", "*jailbreak prompt*",
  "*forget everything you were told*", "*forget previous instructions*",
  "*you are now in*developer mode*",
  "*override your safety*",
  "*hidden system prompt*",
  "*reveal your system prompt*", "*reveal the system prompt*",
  "*dump your system prompt*", "*dump the system prompt*",
  "*print your system prompt*", "*print the system prompt*",
  "*show your system prompt*", "*show the system prompt*",
  "*override your system prompt*", "*override the system prompt*"
)