[Rule Tuning] Misc GenAI Rules (#5929)

Removed changes from:
- rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml
- rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml

(selectively cherry picked from commit 9999336f5e)

rules/cross-platform/command_and_control_common_llm_endpoint.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/09/01"
 integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/04/07"
 
 
 [rule]
@@ -144,7 +144,8 @@ network where host.os.type in ("macos", "windows") and dns.question.name != null
           "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe"
         ) and
     not (?process.code_signature.trusted == true and
-         ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS"))
+         ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS",
+                                                  "OpenJS Foundation", "Developer ID Application: Node.js Foundation (HX7739G8FX)"))
 '''
 
 

rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/09/18"
 integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
 maturity = "production"
-updated_date = "2026/04/01"
+updated_date = "2026/04/07"
 
 [rule]
 author = ["Elastic"]
@@ -115,7 +115,7 @@ process.parent.name in ("node", "bun", "node.exe", "bun.exe") and (
   process.name in ("curl", "wget", "curl.exe", "wget.exe")
 )
 ) and not (
-  process.command_line like ("*127.0.0.1*", "*localhost*", "*/home/*/.claude/shell-snapshots/*", "*/root/.claude/shell-snapshots/snapshot*") or
+  process.command_line like ("*127.0.0.1*", "*localhost*", "*/home/*/.claude/shell-snapshots/*", "*/root/.claude/shell-snapshots/snapshot*", "*/Users/*/.claude/shell-snapshots/*") or
   process.parent.executable like ("/*/.cursor-server/*node", "/home/*/cursor-agent/*/node") 
 )
 '''

rules/cross-platform/defense_evasion_genai_config_modification.toml

@@ -2,7 +2,7 @@
 creation_date = "2025/12/04"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/04/07"
 
 [rule]
 author = ["Elastic"]
@@ -86,11 +86,15 @@ file.path : (
     */.moltbot/* or */AppData/Roaming/Moltbot/* or
     */.config/openclaw/*
 ) and not (
-  file.extension : (lck or lock or log or png or marker) or
+  file.extension : (lck or lock or log or png or marker or shm or wal or sqlite-shm or sqlite-wal or jsonl or journal or xcuserstate) or
   file.name : .DS_Store or
   file.path : (
     */.claude/cache/* or
     */.claude/statsig/* or
+    */.claude/sessions/* or
+    */.claude/shell-snapshots/* or
+    */.gemini/antigravity-browser-profile/* or
+    */.gemini/tmp/* or
     */.codex/log/* or
     */.codex/sessions/*
   ) or

rules/cross-platform/execution_openclaw_agent_child_process.toml

@@ -2,7 +2,7 @@
 creation_date = "2026/02/02"
 integration = ["endpoint"]
 maturity = "production"
-updated_date = "2026/03/24"
+updated_date = "2026/04/07"
 
 [rule]
 author = ["Elastic"]
@@ -76,8 +76,13 @@ process where event.type == "start" and
   process.parent.name : ("node", "node.exe") and 
   process.parent.command_line : ("*openclaw*", "*moltbot*", "*clawdbot*") and
    process.name : ("bash", "sh", "zsh", "bash.exe", "cmd.exe", "powershell.exe", "curl.exe", "curl", "base64", "xattr", "osascript", "python*", "chmod", "certutil.exe", "rundll32.exe") and
-   not process.command_line in ("/bin/sh -c ip neigh show", "/usr/bin/sh -c ip neigh show",
-                                "/bin/sh -c arp -a -n -l", "/usr/bin/sh -c arp -a -n -l")
+   not process.args in (
+     "ip neigh show",
+     "arp -a -n -l",
+     "ip neighbor show dev wlan0",
+     "ip neighbor show dev eth0",
+     "arp -a | findstr /C:---"
+   )
 '''
 
 

rules/cross-platform/multiple_alerts_llm_by_user_entity.toml

@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2026/02/12"
 maturity = "production"
-updated_date = "2026/02/12"
+updated_date = "2026/04/07"
 
 [rule]
 author = ["Elastic"]
@@ -80,7 +80,7 @@ from .alerts-security.*
 | eval users_list = MV_CONCAT(Esql.user_name_values, ",")
 
 // LLM analysis
-| eval instructions = "Analyze the provided user names and return a boolean value true if at least 2 of them are similar and they may belong to the same human identify or false if not, do not compare user names that may look like service accounts. If the list of users has more than 2 users and only 2 of them are similar consider this as true. Structure the output as follows: verdict=<verdict> confidence=<score> summary=<short reason max 500 words> without any other response statements on a single line."
+| eval instructions = "Analyze the provided user names and return a boolean value true if at least 2 of them are similar and they may belong to the same human identify or false if not, do not compare user names that may look like service accounts. If the list of users has more than 2 users and only 2 of them are similar consider this as true. Structure the output as follows: verdict=<verdict> confidence=<score between 0.0 and 1.0> summary=<short reason max 500 words> without any other response statements on a single line."
 | eval prompt = CONCAT("User identities extracted from different alerts: ", users_list, instructions)
 | COMPLETION triage_result = prompt WITH { "inference_id": ".gp-llm-v2-completion"}