From c57e7c3a3587236f8f8b4382bacde46b13c5e0d5 Mon Sep 17 00:00:00 2001 From: Mika Ayenson Date: Fri, 9 Oct 2026 11:39:52 -0500 Subject: [PATCH] [Docs] Align Base64 Piped to Interpreter query with detection-rules Remove customer-specific /.aimee-code/ path from the documented EQL exclusion; match detection-rules #6943 (/home/*/bin/claude|opencode). --- ...8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc | 2 +- ...8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc | 2 +- .../base64-decoded-payload-piped-to-interpreter.asciidoc | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc index 825b56319b..fd20004dc6 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-27/prebuilt-rule-8-19-27-base64-decoded-payload-piped-to-interpreter.asciidoc @@ -160,7 +160,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or (process.name like "python*" and ?process.parent.name == "python*") or process.args like "/tmp/apt-key-gpghome*" or - ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or + ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*" )] diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc index 35c18d7771..1d312d020f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-19-34/prebuilt-rule-8-19-34-base64-decoded-payload-piped-to-interpreter.asciidoc @@ -166,7 +166,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or (process.name like "python*" and ?process.parent.name == "python*") or process.args like "/tmp/apt-key-gpghome*" or - ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or + ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*" )] diff --git a/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc index c4ed0a06ab..2699b9af99 100644 --- a/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/base64-decoded-payload-piped-to-interpreter.asciidoc @@ -166,7 +166,7 @@ sequence by host.id, process.parent.entity_id with maxspan=3s (?process.parent.name == "zsh" and ?process.parent.command_line like "*extendedglob*") or (process.name like "python*" and ?process.parent.name == "python*") or process.args like "/tmp/apt-key-gpghome*" or - ?process.parent.executable like ("/home/*/.aimee-code/bin/claude", "/home/*/.aimee-code/bin/opencode") or + ?process.parent.executable like ("/home/*/bin/claude", "/home/*/bin/opencode") or ?process.parent.command_line like "*/home/*/.claude/shell-snapshots/snapshot-*" )]