Update rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml

Mikaayenson · Aegrah · web-flow · commit ddd8f6ac62cc · 2025-12-05T12:06:36.000-06:00
Co-authored-by: Ruben Groenewoud &lt;78494512+Aegrah@users.noreply.github.com&gt;
diff --git a/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml b/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml
@@ -79,7 +79,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type == "start" and event.type == "start" and
+process where event.type == "start" and
 
   // GenAI parent process
   (

Original file line number	Diff line number	Diff line change
`@@ -79,7 +79,7 @@ timestamp_override = "event.ingested"`
`79`	`79`	`type = "eql"`
`80`	`80`
`81`	`81`	`query = '''`
`82`		`-process where event.type == "start" and event.type == "start" and`
	`82`	`+process where event.type == "start" and`
`83`	`83`
`84`	`84`	`// GenAI parent process`
`85`	`85`	`(`