✄𐘗
text code block:
✄𐘗file where host.os.type in ("windows", "macos") and
  event.action in ("creation", "modification", "overwrite", "rename") and
  event.outcome == "success" and
  file.path : (
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd.zst",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\vmlinuz",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\rootfs.vhdx",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx"
  ) and
  not (
    (process.name : "claude.exe" and
     process.executable : "?:\\Program Files\\WindowsApps\\Claude_*\\app\\claude.exe") or
    (process.name : ("Claude", "Claude Helper") and
     process.executable like "/Applications/Claude.app/*")
  )