Code Editor Untrusted or Unsigned Child Process Execution

process where event.type == "start" and event.action == "exec" and
 process.Ext.effective_parent.executable in ("/Applications/IntelliJ IDEA.app/Contents/MacOS/idea",
                                             "/Applications/Visual Studio Code.app/Contents/MacOS/Electron",
                                             "/Applications/Cursor.app/Contents/MacOS/Cursor") and 
 process.parent.name in ("bash", "sh", "zsh") and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and 
 process.code_signature.signing_id regex~ """[A-Za-z0-9\_\s]{2,}\-[a-z0-9]{40}""" and 
 process.args_count <= 4 and
 not process.executable like~
                          ("/opt/homebrew/*",
                           "/Users/*/.homebrew/Cellar/*",
                           "/nix/store/*",
                           "/usr/local/microsoft/powershell/7/pwsh", 
                           "/usr/local/Cellar/*",
                           "/opt/nordic/ncs/toolchains/*/Cellar/*",
                           "/Users/*/homebrew/Cellar/*") and 
 not process.command_line like~ ("bento completion zsh --silent", "*http://localhost*") and
 not process.code_signature.signing_id like~ ("python3-*", 
                                              "ruby-*", 
                                              "python-*", 
                                              "node-*", 
                                              "rg-*")