✄𐘗
text code block:
✄𐘗any where host.os.type == "linux" and event.category in ("file", "process") and process.interactive == true and container.id like "?*" and (
  (event.category == "file" and event.type == "deletion" and file.name in (".bash_history", ".sh_history",  ".zsh_history")) or
  (event.category == "process" and event.type == "start" and event.action == "exec" and (
    (
      (
        process.args in (
          "rm", "/bin/rm", "/usr/bin/rm", "/usr/local/bin/rm",
          "echo", "/bin/echo", "/usr/bin/echo", "/usr/local/bin/echo"
        ) or
        (process.args in ("ln", "/bin/ln", "/usr/bin/ln", "/usr/local/bin/ln") and process.args == "-sf" and process.args == "/dev/null") or
        (process.args in ("truncate", "/bin/truncate", "/usr/bin/truncate", "/usr/local/bin/truncate") and process.args == "-s0")
      ) and process.args like ("*.bash_history*", "*.sh_history*", "*.zsh_history*")
    ) or
    (process.name == "history" and process.args == "-c") or
    (process.args == "export" and process.args in ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
    (process.args == "unset" and process.args == "HISTFILE") or
    (process.args == "set" and process.args == "history" and process.args == "+o")
  )
 )
)