create filter/predicate to avoid tampering with third party application

Do we have any generic predicate/filter that we can use to block/alert tampering with third party application, such as:

```bash
sudo rm -rf /Applications/xyz-example.app
```

I feel this could be common use case for multiple organizations and it would be helpful if we can add it to this repo