✄𐘗
text code block:
✄𐘗file where host.os.type == "linux" and event.type in ("creation", "rename") and process.executable != null and
file.path like~ (
  "/usr/lib/python*/sitecustomize.py",
  "/usr/local/lib/python*/sitecustomize.py",
  "/usr/lib/python*/dist-packages/sitecustomize.py",
  "/usr/local/lib/python*/dist-packages/sitecustomize.py",
  "/opt/*/lib/python*/sitecustomize.py",
  "/home/*/.local/lib/python*/site-packages/usercustomize.py",
  "/home/*/.config/python/usercustomize.py"
) and not (
  process.executable in (
    "/usr/local/bin/pip2", "/usr/bin/restic", "/usr/bin/pacman", "/usr/bin/dockerd", "/usr/local/bin/pip3",
    "/usr/bin/pip3", "/usr/local/bin/pip", "/usr/bin/pip", "/usr/bin/podman", "/usr/local/bin/poetry",
    "/usr/bin/poetry", "/usr/bin/pamac-daemon", "./venv/bin/pip"
  ) or
  process.executable like~ (
    "/usr/bin/python*", "/usr/local/bin/python*", "/opt/venv/bin/python*",
    "/nix/store/*libexec/docker/dockerd", "/snap/docker/*dockerd"
  )
)