[
  "\\brm\\s+(?=[^\\n;&|]*(?:-[a-zA-Z]*r[a-zA-Z]*f[a-zA-Z]*\\b|-[a-zA-Z]*f[a-zA-Z]*r[a-zA-Z]*\\b|-[a-zA-Z]*r[a-zA-Z]*\\b[^\\n;&|]*-[a-zA-Z]*f[a-zA-Z]*\\b|-[a-zA-Z]*f[a-zA-Z]*\\b[^\\n;&|]*-[a-zA-Z]*r[a-zA-Z]*\\b|--recursive\\b[^\\n;&|]*(?:--force\\b|-[a-zA-Z]*f[a-zA-Z]*\\b)|(?:--force\\b|-[a-zA-Z]*f[a-zA-Z]*\\b)[^\\n;&|]*--recursive\\b))",
  "\\bmkfs\\.",
  "\\bdd\\s+if=.*\\s+of=/dev/",
  "\\b(shutdown|reboot|poweroff|halt)\\b",
  ":\\(\\)\\{\\s*:\\|:\\&\\s*\\};:",
  ">\\s*/dev/sd",
  "\\bchmod\\s+(-[a-zA-Z]*R[a-zA-Z]*|--recursive)\\s+777\\s+/",
  "\\bmv\\s+/\\s",
  ":\\s*>\\s*/etc/",
  "\\bcurl\\s+.*\\|\\s*\\bsudo\\s+\\bbash\\b",
  "\\bwget\\s+.*\\|\\s*\\bsudo\\s+\\bbash\\b",
  "base64.*\\|.*(?:ba)?sh",
  "\\beval\\b",
  "\\$\\(",
  "`.+`"
]