I think you'd have to make it ignore bash, some form of root escalation tool (probably sudo), systemd, everything else I think should be fair game