Osascript Payload Drop and Execute

sequence with maxspan=15s
[file where event.action == "modification" and 
  (file.path like~ ("/Users/Shared/*", 
                    "/tmp/*", 
                    "/private/tmp/*", 
                    "/var/tmp/*", 
                    "/private/var/tmp/*",
                    "/Users/*/Library/Assistant/CustomVocabulary/*", 
                    "/private/var/folders/*", 
                    "/var/folders/*") or
   file.name like ".*") and
   file.extension in ("scpt", "sh", "js", "lock") and
   not file.path like~ ("/tmp/claude/*", "/private/tmp/claude/*", "/private/tmp/claude-*/*")] as event0
[process where event.type == "start" and event.action == "exec" and 
  process.name == "osascript" and stringcontains~(process.command_line, event0.file.name) and
  not process.args == "-e" and
  not (process.parent.name in ("zsh", "bash", "sh") and process.parent.command_line : (
    "*/.claude/shell-snapshots/*",
    "*/.codex/shell_snapshots/*",
    "*/.cursor/shell-snapshots/*"))]