LoFP / developers who explicitly instruct an agent to tear down a development environment or rotate access keys will trigger this rule. confirm intent with the user before escalating.

event.category : "process" and event.type : "start" and event.action : (start or exec) and
(
  process.parent.name : (
    qterm or qterm.exe or qchat or qchat.exe or
    kiro or "kiro-cli" or "kiro-cli-chat" or "kiro-cli-term" or
    kiro.exe or "kiro-cli.exe" or "kiro-cli-chat.exe" or "kiro-cli-term.exe" or
    claude or "claude-bin" or claude.exe or codex or codex.exe or
    copilot or copilot.exe or cursor or cursor.exe or "Cursor Helper (Plugin)" or "Cursor Helper" or
    "gemini-cli" or "gemini-cli.exe" or windsurf or windsurf.exe or
    aider or aider.exe or cline or goose or goose.exe or opencode or opencode.exe
  ) or
  process.parent.executable : (
    */.local/bin/q or */usr/local/bin/q or
    *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\q.exe or
    *\\Users\\*\\AppData\\Local\\Programs\\Amazon Q\\*\\q.exe or
    *\\Program Files\\Amazon Q\\q.exe or
    *\\Program Files\\Amazon Q\\*\\q.exe
  ) or
  (
    process.parent.name : (bash or zsh or sh or dash or cmd.exe or powershell.exe or pwsh or pwsh.exe) and
    process.parent.command_line : (
      */.claude/shell-snapshots/* or *\\.claude\\shell-snapshots\\* or
      */.codex/* or *\\.codex\\* or
      */.kiro/* or *\\.kiro\\* or
      */.aws/amazonq/* or *\\.aws\\amazonq\\* or
      */.goose/* or */.opencode/* or */.aider*
    )
  )
) and
(
  (
    process.name : (aws or aws.exe) and
    process.command_line : (
      *ec2 terminate-instances* or *ec2 delete-volume* or *ec2 delete-snapshot* or
      *s3 rb* or *s3 rm*--recursive* or *s3api delete-bucket* or *s3api delete-objects* or
      *iam delete-user* or *iam delete-role* or *iam delete-login-profile* or *iam delete-access-key* or
      *rds delete-db-instance* or *rds delete-db-cluster* or *dynamodb delete-table* or
      *efs delete-file-system* or *eks delete-cluster* or *ecs delete-cluster* or
      *lambda delete-function* or *kms schedule-key-deletion* or
      *cloudformation delete-stack* or
      *cloudtrail delete-trail* or *cloudtrail stop-logging* or
      *backup delete-recovery-point* or *organizations close-account*
    )
  ) or
  (
    process.name : (sam or sam.exe) and process.command_line : *sam delete*
  ) or
  (
    process.name : (terraform or terraform.exe or tofu or tofu.exe) and
    process.command_line : *destroy*-auto-approve*
  ) or
  (
    process.name : (kubectl or kubectl.exe) and
    process.command_line : (*delete*--all* or *delete namespace* or *delete ns*)
  )
) and not process.args : ("--dry-run*" or "--help*" or "-help*" or "-h" or "help" or "--version*")