diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc
index 825b56319b..fd20004dc6 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc
@@ -160,7 +160,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s
     (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or
     (process.name like "python*" and ?process.parent.name == "python*") or
     process.args like "/tmp/apt-key-gpghome*" or
-    ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or
+    ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or
     ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*"
   )]
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc
index 35c18d7771..1d312d020f 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc
@@ -166,7 +166,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s
     (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or
     (process.name like "python*" and ?process.parent.name == "python*") or
     process.args like "/tmp/apt-key-gpghome*" or
-    ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or
+    ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or
     ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*"
   )]
 
diff --git a/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc
index c4ed0a06ab..2699b9af99 100644
--- a/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc
@@ -166,7 +166,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s
     (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or
     (process.name like "python*" and ?process.parent.name == "python*") or
     process.args like "/tmp/apt-key-gpghome*" or
-    ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or
+    ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or
     ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*"
   )]