config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (actor_process_image_path contains "/node" and 
 ((action_process_image_path contains "/bun" and 
 (action_process_image_command_line in ("*bun_environment.js*", "*https://github.com/actions/runner/releases/download/v2.330.0*"))) or 
 (action_process_image_command_line contains "curl " and 
 action_process_image_command_line contains "-fsSL" and 
 action_process_image_command_line contains "https://bun.sh/install" and 
 action_process_image_command_line contains "bash") or 
 (action_process_image_command_line contains "bash -c \"source " and 
 action_process_image_command_line contains "&& echo"))))