diff --git a/rules/cross-platform/command_and_control_common_llm_endpoint.toml b/rules/cross-platform/command_and_control_common_llm_endpoint.toml index b15f7f8f5..480563b94 100644 --- a/rules/cross-platform/command_and_control_common_llm_endpoint.toml +++ b/rules/cross-platform/command_and_control_common_llm_endpoint.toml @@ -2,7 +2,7 @@ creation_date = "2025/09/01" integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/04/07" [rule] @@ -144,7 +144,8 @@ network where host.os.type in ("macos", "windows") and dns.question.name != null "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe" ) and not (?process.code_signature.trusted == true and - ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS")) + ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS", + "OpenJS Foundation", "Developer ID Application: Node.js Foundation (HX7739G8FX)")) ''' diff --git a/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml b/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml index 69e8783e9..6aff04ecb 100644 --- a/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml +++ b/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml @@ -2,7 +2,7 @@ creation_date = "2025/09/18" integration = ["endpoint", "windows", "system", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"] maturity = "production" -updated_date = "2026/04/01" +updated_date = "2026/04/07" [rule] author = ["Elastic"] @@ -115,7 +115,7 @@ process.parent.name in ("node", "bun", "node.exe", "bun.exe") and ( process.name in ("curl", "wget", "curl.exe", "wget.exe") ) ) and not ( - process.command_line like ("*127.0.0.1*", "*localhost*", "*/home/*/.claude/shell-snapshots/*", "*/root/.claude/shell-snapshots/snapshot*") or + process.command_line like ("*127.0.0.1*", "*localhost*", "*/home/*/.claude/shell-snapshots/*", "*/root/.claude/shell-snapshots/snapshot*", "*/Users/*/.claude/shell-snapshots/*") or process.parent.executable like ("/*/.cursor-server/*node", "/home/*/cursor-agent/*/node") ) ''' diff --git a/rules/cross-platform/defense_evasion_genai_config_modification.toml b/rules/cross-platform/defense_evasion_genai_config_modification.toml index cf95d5c68..96066cf10 100644 --- a/rules/cross-platform/defense_evasion_genai_config_modification.toml +++ b/rules/cross-platform/defense_evasion_genai_config_modification.toml @@ -2,7 +2,7 @@ creation_date = "2025/12/04" integration = ["endpoint"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/04/07" [rule] author = ["Elastic"] @@ -86,11 +86,15 @@ file.path : ( */.moltbot/* or */AppData/Roaming/Moltbot/* or */.config/openclaw/* ) and not ( - file.extension : (lck or lock or log or png or marker) or + file.extension : (lck or lock or log or png or marker or shm or wal or sqlite-shm or sqlite-wal or jsonl or journal or xcuserstate) or file.name : .DS_Store or file.path : ( */.claude/cache/* or */.claude/statsig/* or + */.claude/sessions/* or + */.claude/shell-snapshots/* or + */.gemini/antigravity-browser-profile/* or + */.gemini/tmp/* or */.codex/log/* or */.codex/sessions/* ) or diff --git a/rules/cross-platform/execution_openclaw_agent_child_process.toml b/rules/cross-platform/execution_openclaw_agent_child_process.toml index c2a5536ac..c6bb5d207 100644 --- a/rules/cross-platform/execution_openclaw_agent_child_process.toml +++ b/rules/cross-platform/execution_openclaw_agent_child_process.toml @@ -2,7 +2,7 @@ creation_date = "2026/02/02" integration = ["endpoint"] maturity = "production" -updated_date = "2026/03/24" +updated_date = "2026/04/07" [rule] author = ["Elastic"] @@ -76,8 +76,13 @@ process where event.type == "start" and process.parent.name : ("node", "node.exe") and process.parent.command_line : ("*openclaw*", "*moltbot*", "*clawdbot*") and process.name : ("bash", "sh", "zsh", "bash.exe", "cmd.exe", "powershell.exe", "curl.exe", "curl", "base64", "xattr", "osascript", "python*", "chmod", "certutil.exe", "rundll32.exe") and - not process.command_line in ("/bin/sh -c ip neigh show", "/usr/bin/sh -c ip neigh show", - "/bin/sh -c arp -a -n -l", "/usr/bin/sh -c arp -a -n -l") + not process.args in ( + "ip neigh show", + "arp -a -n -l", + "ip neighbor show dev wlan0", + "ip neighbor show dev eth0", + "arp -a | findstr /C:---" + ) ''' diff --git a/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml b/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml index dafc5fe6f..3b76e58ab 100644 --- a/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml +++ b/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2026/02/12" maturity = "production" -updated_date = "2026/02/12" +updated_date = "2026/04/07" [rule] author = ["Elastic"] @@ -80,7 +80,7 @@ from .alerts-security.* | eval users_list = MV_CONCAT(Esql.user_name_values, ",") // LLM analysis -| eval instructions = "Analyze the provided user names and return a boolean value true if at least 2 of them are similar and they may belong to the same human identify or false if not, do not compare user names that may look like service accounts. If the list of users has more than 2 users and only 2 of them are similar consider this as true. Structure the output as follows: verdict= confidence= summary= without any other response statements on a single line." +| eval instructions = "Analyze the provided user names and return a boolean value true if at least 2 of them are similar and they may belong to the same human identify or false if not, do not compare user names that may look like service accounts. If the list of users has more than 2 users and only 2 of them are similar consider this as true. Structure the output as follows: verdict= confidence= summary= without any other response statements on a single line." | eval prompt = CONCAT("User identities extracted from different alerts: ", users_list, instructions) | COMPLETION triage_result = prompt WITH { "inference_id": ".gp-llm-v2-completion"}