✄𐘗
text code block:
✄𐘗process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
  process.name in ("curl", "nscurl") and process.command_line like "*https://jamf.*" and
  ((process.parent.code_signature.exists == false or process.parent.code_signature.trusted == false) or
   process.parent.name in ("osascript", "node", "perl", "ruby") or
   process.parent.name like "python*")