[Security Rules] Update security rules package to v9.3.6-beta.1

[tradebot-elastic]

What does this PR do?

Update the Security Rules package to version 9.3.6-beta.1.
Autogenerated from commit https://github.com/elastic/detection-rules/tree/05c5c5cdc5b5ed239b2a85610cf7a47375ce2361

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

• Install the most recently release security rules in the Detection Engine
• Install the package
• Confirm the update is available in Kibana. Click "Update X rules" or "Install X rules"
• Look at the changes made after the install and confirm they are consistent

How to test this PR locally

• Perform the above checklist, and use package-storage to build EPR from source

Related issues

None

Screenshots

None

[shashank-elastic]

Awaiting a recent change confirmation before we approve and merge.

[macroscopeapp]

🟢 Low security_rule/44cb1d8a-1922-4fc0-a00f-36c1caf57393_1.json:8

The rule queries logs-endpoint.events.process* but the EQL query uses file where to detect file creation events. File events are stored in logs-endpoint.events.file*, so the rule will never match any events and will fail to detect the CVE.

-            "logs-endpoint.events.process*"
+            "logs-endpoint.events.file*"

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/security_detection_engine/kibana/security_rule/44cb1d8a-1922-4fc0-a00f-36c1caf57393_1.json around lines 8-10:

The rule queries `logs-endpoint.events.process*` but the EQL query uses `file where` to detect file creation events. File events are stored in `logs-endpoint.events.file*`, so the rule will never match any events and will fail to detect the CVE.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: b4cf237

cc @shashank-elastic

[elastic-vault-github-plugin-prod]

Package security_detection_engine - 9.3.6-beta.1 containing this change is available at https://epr.elastic.co/package/security_detection_engine/9.3.6-beta.1/