dev-v2.1.0

Changes

• [FR] Upgrade eql to 1.0.1, align KQL with lark 1.x, and fix NTLM relay field comparison (#6611) @Mikaayenson
• [New Rule] Newly Observed RC4 Kerberos Service Ticket Request (#6587) @w0rk3r
• [New Rule] Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension (#6272) @eric-forte-elastic
• [New Rule] First Time Seen RMM Signer Across the Environment (#6522) @w0rk3r
• [New Rule] Azure AKS Service Account Token Created via TokenRequest API (#6422) @terrancedejesus
• [Rule: Tuning] Rule triggers for false positive due to broad wildcard (#6205) @litemars
• [Rule Tuning] Windows Misc Tunings (#6568) @w0rk3r
• [New Rule] Potential NFS Destructive Operation Burst (#6536) @eric-forte-elastic
• [New Rule] Azure AKS Certificate Signing Request Created or Approved (#6420) @terrancedejesus
• [New Rule] Potential EDR-Freeze via WerFaultSecure Abuse (#6248) @Aryu-RU
• [Deprecation] Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt (#6567) @Aegrah
• [Rule Tuning] Suspicious Service was Installed in the System (#6523) @w0rk3r
• [New Rule] Suspicious UID Change to Root via Python (#6566) @Aegrah
• [Rule Tuning] Wrong regex in the macOS c2 detection query (#6548) @litemars
• [Rule Tuning] Fixing Typo in the macOS persistence emond modification rule (#6529) @litemars
• [Rule: Tuning] Fixing logic issue on the macOS rule for discovery external IP using curl (#6530) @litemars
• [New Rule] Direct Process Execution via setsid, nohup, or disown (#6526) @Aegrah
• [New Rule] Azure AKS CoreDNS or Kube-DNS Configuration Modified (#6417) @terrancedejesus
• [New Rule] Azure AKS Secret get or list with Suspicious User Agent (#6421) @terrancedejesus
• [New Rule] NFS AUTH_SYS Root UID Access (#6535) @eric-forte-elastic
• [Rule Tuning] Connection to Commonly Abused Web Services (#6451) @Mikaayenson
• [Rule Tuning] Potential Data Exfiltration Through Curl (#6520) @Mikaayenson
• [New Rule] Mark-of-the-Web Removal by an Unusual Process (#6533) @w0rk3r
• [Rule Tuning] M365 Identity Login from Atypical Region (#6409) @Mikaayenson
• [Rule Tuning] Entra ID User Sign-in with Unusual Client (#6429) @Mikaayenson
• [Rule Tuning] Entra ID High Risk Sign-in (#6408) @Mikaayenson
• [New Rules] GCP GKE Rule Conversions Part 6 (#6482) @imays11
• [New Rule] First Time Seen Memcached Writer (#6534) @eric-forte-elastic
• [New Rule] Destructive MongoDB Command (#6540) @eric-forte-elastic
• [New Rule] MySQL User-Defined Function Injection (#6541) @eric-forte-elastic
• [New Rule] Postgresql COPY PROGRAM Command Execution (#6542) @eric-forte-elastic
• [New Rule] Cassandra JavaScript UDF Creation (#6543) @eric-forte-elastic
• [Rule Tuning] Potential Computer Account NTLM Relay Activity (#6512) @eric-forte-elastic
• [New Rule] Thrift RPC Method from an External Client (#6544) @eric-forte-elastic
• [New Rule] Potential SIP REGISTER Brute Force (#6538) @eric-forte-elastic
• [New Rule] Potential SIP Extension Enumeration (#6539) @eric-forte-elastic
• [New Rule] Successful AMQP Multi-Queue Purge Burst (#6546) @eric-forte-elastic
• [New Rule] Multiple SonicWall Login Failures Followed by Successful Login (#6514) @eric-forte-elastic
• [New Rule] AWS Bedrock High Risk Filesystem or Execution Tool Invocation (#6510) @bryans3c
• [New Rule] AWS Batch Job Submitted with Container Override by Unusual Identity (#6509) @bryans3c
• [New Rule] AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity (#6508) @bryans3c
• [New Rule] AWS IAM User Created Own Access Key (#6436) @bryans3c
• [New Rule] AWS SageMaker Execution Role Passed by Unusual Principal (#6435) @bryans3c
• [Rule Tuning] AWS Bedrock High-Frequency Single-Model Inference API Probing (#6411) @bryans3c
• [New Rule] AWS S3 Bucket ACL Modified to Allow Public Access by New Identity (#6507) @bryans3c
• [New Rule] AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity (#6505) @bryans3c
• [Rule Tuning] Misc Windows Tunings (#6513) @w0rk3r
• [New Rule] Unusual File Creation via Web Server (#6496) @Aegrah
• [New Rule] Azure AKS Kubernetes Events Deleted (#6423) @terrancedejesus
• [New Rule] Azure AKS Potential API Enumeration by User (#6424) @terrancedejesus
• [New/Tuning] Potential Tunneling via Tailscaled (#6519) @Aegrah
• [Rule Tuning] Removing process.interactive == true Enforcement (#6518) @Aegrah
• [Rule Tuning] Higher-Order Multi Att&ck Tactics rules (#6480) @w0rk3r
• [Rule Tuning] Potential Computer Account NTLM Relay Activity (#6431) @Mikaayenson
• [New Rule] Azure AKS Suspicious Self-Subject Review via Service Account (#6425) @terrancedejesus
• [New Rule] Azure AKS Ephemeral Container Added to Pod (#6426) @terrancedejesus
• Update related integrations for ML detection rules (#6497) @sodhikirti07
• [Rule Tuning] Potential Credential Access via DCSync (#6415) @Mikaayenson
• [Rule Tuning] Persistence via Scheduled Job Creation (#6481) @w0rk3r
• [Rule Tuning] Expand Comsvcs MiniDump ordinal coverage (#6489) @django-88
• [Rule Tuning] PHP File Creation in WordPress Plugin Directory (#6485) @Aegrah
• [Rule Tuning] Newly Observed Palo Alto Network Alert (#6477) @eric-forte-elastic
• Wget and curl LLM assisted rules (#6448) @aarju
• [New Rules] GCP GKE Rule Conversions Part 5 (#6466) @imays11
• [Rule Tuning] GenAI Process Connection to Unusual Domain (#6462) @Mikaayenson
• [Rule Tuning] Web Application Suspicious Activity: Unauthorized Method (#6467) @Mikaayenson
• [New Rule] Azure AKS User Exec into Pod (#6427) @terrancedejesus
• [New Rules] GCP GKE Rule Conversions Part 4 (#6456) @imays11
• [Rule Tuning] Suspicious Child Execution via Web Server (#6472) @Mikaayenson
• [New Rules] GCP GKE CSR Abuse Rules (#6405) @imays11
• [New Rules] GCP GKE Rule Conversions Part 3 (#6445) @imays11
• [Rule Tuning] Misc. Linux LPE Rules (#6465) @Aegrah
• [Rule Tuning] Lucene Network Rules Language Conversion (#6463) @eric-forte-elastic
• [Rule Tuning] Web Application Suspicious Activity: POST Request Declined (#6469) @eric-forte-elastic
• [New Rule/Tuning] PHP File Creation in WordPress Plugin Directory (#6473) @Aegrah

🚀 Features

• [FR] Add nested KQL query support in lib/kql (#6492) @imays11
• [FR] Add XDR rule tag taxonomy to Copilot PR review (#6591) @Mikaayenson
• Lock versions for releases: 8.19,9.3,9.4,9.5 (#6569) @github-actions[bot]
• chore: bump setup tools (#6545) @eric-forte-elastic
• [FR] Switch to ephemeral tokens for non DR workflows (#6524) @eric-forte-elastic
• Lock versions for releases: 8.19,9.3,9.4,9.5 (#6478) @github-actions[bot]
• Prep for Release 9.5 (#6474) @shashank-elastic

🐛 Bug Fixes

• [Bug] Patch mixin for schema update and add support for pre-built rules as custom rules (#6603) @eric-forte-elastic
• [Bug] KQL non-quoted spaces parsing support (#6388) @eric-forte-elastic
• [Bug] Edge case rule loading bugs (#6532) @eric-forte-elastic
• [Bug] Use built-in github.token for Branch Version Status Checks (#6531) @eric-forte-elastic
• [Bug] Pin ruff version to fix failing CI (#6494) @eric-forte-elastic
• [Bug] Allow ES|QL Dynamic Fields in Alert Suppression Schema Test (#6476) @eric-forte-elastic
• [Bug] Fix MITRE v19 testing harness (#6470) @eric-forte-elastic

🛠 Internal Changes

• [Bug] Patch mixin for schema update and add support for pre-built rules as custom rules (#6603) @eric-forte-elastic
• [Bug] KQL non-quoted spaces parsing support (#6388) @eric-forte-elastic
• [FR] Add nested KQL query support in lib/kql (#6492) @imays11
• [Bug] Edge case rule loading bugs (#6532) @eric-forte-elastic
• [FR] Add XDR rule tag taxonomy to Copilot PR review (#6591) @Mikaayenson
• Update 9.5.0 Beats and ECS schemas (#6590) @shashank-elastic
• Monthly Manifest and Schema Refresh + investigation guides (#6565) @shashank-elastic
• [Rule Tuning] Add Resources: LLM tag for ES|QL COMPLETION rules (#6506) @Mikaayenson
• chore: bump setup tools (#6545) @eric-forte-elastic
• Add API schemas for 9.5 (#6550) @shashank-elastic
• Add Data Source tags to the ML detection rules (#6511) @sodhikirti07
• [Bug] Pin ruff version to fix failing CI (#6494) @eric-forte-elastic
• [Bug] Allow ES|QL Dynamic Fields in Alert Suppression Schema Test (#6476) @eric-forte-elastic
• Prep for Release 9.5 (#6474) @shashank-elastic
• [Bug] Fix MITRE v19 testing harness (#6470) @eric-forte-elastic