✄𐘗
text code block:
✄𐘗process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and 
  process.name in ("curl", "nscurl") and 
  process.args in ("-o", "--output", "--download", "-dl", "-dir", "--directory") and
  process.args regex~ """http.*:\/\/[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}.[0-9]{2,3}\/.*""" and 
  process.parent.name like~ ("bash", "sh", "zsh", "osascript", "tclsh*", "python*") and
  process.Ext.effective_parent.executable like "/Applications/*" and
  process.args_count <= 10 and 
  not process.args like "/Applications/*" and
  not process.Ext.effective_parent.executable in ("/Applications/iTerm.app/Contents/MacOS/iTerm2",
                                                   "/Applications/Visual Studio Code.app/Contents/MacOS/Electron", 
                                                   "/Applications/Warp.app/Contents/MacOS/stable")