Update command_and_control_common_llm_endpoint.toml

Author: Samirbous

rules/windows/command_and_control_common_llm_endpoint.toml

@@ -1,6 +1,6 @@
 [metadata]
 creation_date = "2025/09/01"
-integration = ["endpoint", "windows", "sentinel_one_cloud_funnel", "crowdstrike"]
+integration = ["endpoint", "windows", "sentinel_one_cloud_funnel"]
 maturity = "production"
 updated_date = "2025/09/01"
 
@@ -16,7 +16,6 @@ index = [
     "endgame-*",
     "logs-endpoint.events.network-*",
     "logs-sentinel_one_cloud_funnel.*",
-    "logs-crowdstrike.fdr*",
     "logs-windows.forwarded*",
     "logs-windows.sysmon_operational-*",
     "winlogbeat-*"
@@ -67,7 +66,6 @@ tags = [
     "Data Source: Elastic Endgame",
     "Data Source: Elastic Defend",
     "Data Source: SentinelOne",
-    "Data Source: Crowdstrike",
     "Data Source: Sysmon",
 ]
 timestamp_override = "event.ingested"
@@ -80,11 +78,9 @@ network where host.os.type == "windows" and dns.question.name != null and
   "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "python.exe", "regsvr32.exe", "dllhost.exe",
   "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com") or
 
-  ?process.code_signature.exists == false or ?process.code_signature.trused == false or
-
   ?process.code_signature.subject_name in ("AUTOIT CONSULTING LTD", "AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
 
-  ?process.executable : ("?:\\Users\\*.exe", "", "?:\\ProgramData\\*.exe",  "?\\Device\\HarddiskVolume?\\Users\\*.exe",  "?\\Device\\HarddiskVolume?\\ProgramData\\*.exe")
+  (process.executable : ("?:\\Users\\*.exe", "", "?:\\ProgramData\\*.exe") and ?process.code_signature.trusted != true)
  ) and
     dns.question.name : (
     // Major LLM APIs
@@ -128,7 +124,7 @@ network where host.os.type == "windows" and dns.question.name != null and
     "chat.deepseek.com"
   ) and
 
-  not ?process.executable : (
+  not process.executable : (
           "?:\\Program Files\\*.exe",
           "?:\\Program Files (x86)\\*.exe",
           "?:\\Windows\\System32\\svchost.exe",