Persistence via GenAI Tool

sequence by process.entity_id with maxspan=1m
[process where event.type == "start" and event.action in ("exec", "start") and
 (
  process.parent.name in ("claude", "claude.exe", "cursor.exe", "cursor", "Cursor", "codex", "codex.exe", "sandbox-exec",
  "openai", "openai.exe", "ollama.exe", "ollama", "textgen.exe", "textgen", "lmstudio.exe", "lmstudio",
  "copilot.exe", "copilot", "gemini-cli.exe", "llm", "windsurf", "windsurf.exe", "Windsurf.exe", "Windsurf Helper", "Windsurf Helper (Plugin)", "Windsurf Helper (Renderer)", "Windsurf Helper (GPU)") or

  descendant of [process where event.action in ("exec", "start") and
                 process.parent.name in ("claude", "claude.exe", "cursor.exe", "cursor", "codex", "codex.exe", "sandbox-exec",
                 "openai", "openai.exe", "ollama.exe", "ollama", "textgen.exe", "textgen", "lmstudio.exe", "lmstudio", "copilot.exe",
                 "copilot", "gemini-cli.exe", "llm", "windsurf", "windsurf.exe", "Windsurf.exe", "Windsurf Helper", "Windsurf Helper (Plugin)", "Windsurf Helper (Renderer)", "Windsurf Helper (GPU)")]
 ) and
 not process.Ext.effective_parent.executable == "/opt/jc/bin/jumpcloud-agent" and
 not (process.executable like ("/opt/homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby",
                               "/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/*/bin/ruby") and
      process.args in ("/opt/homebrew/Library/Homebrew/brew.rb",
                       "/usr/local/Homebrew/Library/Homebrew/brew.rb") and
      process.args == "services")]
[file where not event.action in ("deletion", "open", "rename") and
  file.path : ("/private/etc/rc.local",
               "/etc/rc.local",
               "/etc/sudoers",
               "/System/Library/LaunchAgents/*.plist",
               "/Library/LaunchAgents/*.plist",
               "/Users/*/Library/LaunchAgents/*.plist",
               "/System/Library/LaunchDaemons/*.plist",
               "/Library/LaunchDaemons/*.plist",
               "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
               "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
  not file.name : "com.github.facebook.watchman.plist" and
  not process.code_signature.subject_name == "Ollama Inc."]