\brm\s+-rf\s+/
\bdd\b.*\bof=/dev/(sd|vd|nvme)
\bmkfs(\.[a-z0-9_+-]+)?\b
\bwipefs\s+-a\b
\bshred\b.*?/dev/
\bkill\s+-9\s+-1\b
\bpkill\s+-9\s+-1\b
\bkillall\b.*\b(systemd|init|sshd)\b
\bshutdown\b
\breboot\b
\bpoweroff\b
\bhalt\b
\b(init|telinit)\s+[06]\b
\b(systemctl|service)\s+(stop|disable|mask|reboot|poweroff|halt)\b
\biptables\b.*\bDROP\b
\bnft\s+flush\s+ruleset\b
\bufw\s+disable\b
\b(chmod|chown|chgrp|chattr)\b
\b(usermod|userdel|groupdel|passwd)\b
\bapt(-get)?\b.*\b(remove|purge|autoremove)\b
\b(dnf|yum|zypper|pacman|rpm)\b.*\b(remove|erase|rm)\b
\bcurl\b.*\|\s*(sh|bash)
\bwget\b.*\|\s*(sh|bash)
\bpython(3)?\b\s+-c\b
\bperl\b\s+-e\b
\bruby\b\s+-e\b
\bnode\b\s+-e\b
\beval\b
\$\(
`
