Tampering of Bash Command-Line History

process where event.type == "start" and event.action == "exec" and (
  (
    (
      process.name in (
        "echo", "rm", "sudo", ".buildkit_qemu_emulator", "vim.basic", "ln", "truncate", "cat",
        "coreutils", "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish"
      ) and (
        process.args in ("rm", "echo") or
        (process.args == "ln" and process.args == "-sf" and process.args == "/dev/null") or
        (process.args == "truncate" and process.args == "-s0")
      )
    ) and
    process.args like (
      ".bash_history", "/root/.bash_history", "/home/*/.bash_history","/Users/.bash_history",
      "/Users/*/.bash_history",".zsh_history", "/root/.zsh_history", "/home/*/.zsh_history",
      "/Users/.zsh_history", "/Users/*/.zsh_history"
    )
  ) or
  (
    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "sudo", "logger") and (
      (process.args == "export" and process.args : ("HISTFILE=/dev/null", "HISTFILESIZE=0")) or
      (process.args == "unset" and process.args : "HISTFILE") or
      (process.args == "set" and process.args == "history" and process.args == "+o")
   )
  ) or
  (process.name == "history" and process.args == "-c")
)