GenAI Process Connection to Unusual Domain

event.category:network and host.os.type:macos and event.action:connection_attempted and
(
  process.name:(
    Claude or "Claude Helper" or "Claude Helper (Plugin)" or Copilot or Cursor or
    "Cursor Helper" or "Cursor Helper (Plugin)" or GPT4All or Jan or "Jan Helper" or
    KoboldCpp or "LM Studio" or Ollama or Windsurf or "Windsurf Helper" or
    "Windsurf Helper (Plugin)" or bunx or claude or codex or copilot or cursor or deno or
    gemini-cli or genaiscript or gpt4all or grok or jan or koboldcpp or llama-cli or
    llama-server or lmstudio or npx or ollama or pnpm or qwen or textgen or windsurf or yarn
  ) or
  (process.name:(node or node.exe) and process.command_line:(*openclaw* or *moltbot* or *clawdbot*))
) and destination.domain:(* and not (
    aka.ms or anthropic.com or atlassian.com or cursor.com or cursor.sh or github.com or
    gpt4all.io or hf.co or huggingface.co or lmstudio.ai or localhost or ollama.ai or
    ollama.com or openai.com or *.aka.ms or *.akamaized.net or *.amazonaws.com or
    *.amplitude.com or *.anthropic.com or *.atlassian.com or *.aws.amazon.com or
    *.azure.com or *.cdn.cloudflare.net or *.cloudflare-dns.com or *.cloudflare.com or
    *.cloudflarestorage.com or *.codeium.com or *.cursor.com or *.cursor.sh or
    *.datadoghq.com or *.elastic-cloud.com or *.elastic.co or *.exp-tas.com or
    *.gemini.google.com or *.generativelanguage.googleapis.com or *.github.com or
    *.githubcopilot.com or *.githubusercontent.com or *.gitkraken.com or *.gitkraken.dev or
    *.google.com or *.googleapis.com or *.gpt4all.io or *.grok.x.ai or *.hf.co or
    *.honeycomb.io or *.huggingface.co or *.intercom.io or *.jan.ai or *.launchdarkly.com or
    *.lmstudio.ai or *.microsoft.com or *.mixpanel.com or *.msedge.net or *.npmjs.com or
    *.npmjs.org or *.ollama.ai or *.ollama.com or *.openai.com or *.pypi.org or
    *.r2.cloudflarestorage.com or *.segment.io or *.sentry.io or *.visualstudio.com or
    *.vsassets.io or *.vscode-cdn.net or *.windsurf.ai or *.x.ai or *.yarnpkg.com or
    *.cartocdn.com or *.chatgpt.com or *.claude.ai or *.claude.com or
    *.claudeusercontent.com or *.ggpht.com or *.gstatic.com or *.googleusercontent.com or
    *.launchpadcontent.net or *.pythonhosted.org or *.recaptcha.net or *.shields.io or
    *.snapcraftcontent.com or *.snapcraft.io or *.stripe.com or *.travis-ci.com or
    *.travis-ci.org or *.ubuntu.com or *.ytimg.com or
    *.github.io or *.githubassets.com or *.jsdelivr.net or *.nodesource.com or
    chatgpt.com or claude.ai or claude.com or flagcdn.com or gitlab.com or
    opencollective.com or pypi.org
))