✄𐘗
text code block:
✄𐘗process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  ((process.parent.executable like ("/Applications/*", "/Volumes/*", "/private/var/folders/*")) or
   (process.parent.name in ("bash", "sh", "zsh") and process.parent.command_line like "*http*") or
   (process.parent.code_signature.trusted == false or process.code_signature.exists == false)) and
  process.name in ("curl", "nscurl") and
  process.args_count <= 5 and
  process.command_line like ("*ip-api.com*", "*ipwho.is*", "*checkip.dyndns.org*", "*api.ipify.org*",
                             "*whatismyip.akamai.com*", "*ifcfg.me*", "*ifconfig.me*", "*ident.me*",
                             "*icanhazip.com*", "*ipecho.net*", "*api.myip.com*", "*checkip.amazonaws.com*",
                             "*wtfismyip.com*", "*iplogger.*", "*freegeoip.net*", "*ipinfo.io*",
                             "*geoplugin.net*", "*httpbin.org*", "*myip.opendns.com*")