From dfe678acd823124788c50620eb75459af2632b5b Mon Sep 17 00:00:00 2001
From: tradebot-elastic <178941316+tradebot-elastic@users.noreply.github.com>
Date: Wed, 7 May 2025 05:10:06 +0000
Subject: [PATCH 1/2] Update latest docs

---
 ...to-establish-vscode-remote-tunnel.asciidoc | 127 +++++++
 ...tic-site-javascript-file-uploaded.asciidoc | 148 ++++++++
 ...ce-against-microsoft-365-accounts.asciidoc | 139 ++++++++
 ...8-17-11-browser-extension-install.asciidoc | 134 ++++++++
 ...n-to-commonly-abused-web-services.asciidoc | 312 +++++++++++++++++
 ...lt-strike-team-server-certificate.asciidoc | 130 +++++++
 ...7-11-docker-release-file-creation.asciidoc |  62 ++++
 ...om-unusual-directory-command-line.asciidoc | 263 +++++++++++++++
 ...used-remote-access-tool-execution.asciidoc | 313 +++++++++++++++++
 ...-download-to-suspicious-directory.asciidoc | 114 +++++++
 ...-17-11-linux-telegram-api-request.asciidoc | 114 +++++++
 ...using-a-known-sunburst-dns-domain.asciidoc | 153 +++++++++
 ...emory-dumping-via-proc-filesystem.asciidoc | 112 +++++++
 ...very-via-etc-exports-or-etc-fstab.asciidoc | 103 ++++++
 ...ing-via-visual-studio-code-client.asciidoc | 137 ++++++++
 ...e-registration-for-user-principal.asciidoc | 121 +++++++
 ...-sign-in-from-a-suspicious-source.asciidoc | 128 +++++++
 ...ld-engine-using-an-alternate-name.asciidoc | 146 ++++++++
 ...gn-ins-with-suspicious-properties.asciidoc | 121 +++++++
 ...ing-via-visual-studio-code-client.asciidoc | 138 ++++++++
 ...tion-anonymized-ip-risk-detection.asciidoc | 128 +++++++
 ...ntra-id-service-principal-created.asciidoc | 141 ++++++++
 ...or-user-principal-via-auth-broker.asciidoc | 136 ++++++++
 ...irst-occurrence-of-client-request.asciidoc | 123 +++++++
 ...otection-alerts-by-user-principal.asciidoc | 120 +++++++
 ...ckdoor-execution-through-pam-exec.asciidoc |  80 +++++
 ...al-data-exfiltration-through-curl.asciidoc | 114 +++++++
 ...ruction-via-environment-variables.asciidoc | 113 +++++++
 ...ayload-execution-via-command-line.asciidoc | 124 +++++++
 ...load-execution-via-common-utility.asciidoc | 186 +++++++++++
 ...or-port-forwarding-via-ssh-option.asciidoc | 110 ++++++
 ...erading-as-business-app-installer.asciidoc | 268 +++++++++++++++
 ...asquerading-as-communication-apps.asciidoc | 184 ++++++++++
 ...cktick-escaped-variable-expansion.asciidoc | 113 +++++++
 ...ia-character-array-reconstruction.asciidoc | 112 +++++++
 ...enated-dynamic-command-invocation.asciidoc | 109 ++++++
 ...high-numeric-character-proportion.asciidoc | 116 +++++++
 ...tion-via-invalid-escape-sequences.asciidoc | 112 +++++++
 ...-obfuscation-via-reverse-keywords.asciidoc | 112 +++++++
 ...ion-via-special-character-overuse.asciidoc | 116 +++++++
 ...uscation-via-string-concatenation.asciidoc | 113 +++++++
 ...-process-name-stomping-with-prctl.asciidoc | 158 +++++++++
 ...indows-error-manager-masquerading.asciidoc | 141 ++++++++
 ...ia-negative-index-string-reversal.asciidoc | 116 +++++++
 ...ecution-from-an-unusual-directory.asciidoc | 191 +++++++++++
 ...gram-files-directory-masquerading.asciidoc | 152 +++++++++
 ...7-threat-command-cves-correlation.asciidoc | 110 ++++++
 ...-rare-connection-to-webdav-target.asciidoc | 105 ++++++
 ...1-remote-file-copy-via-teamviewer.asciidoc | 143 ++++++++
 ...enamed-autoit-scripts-interpreter.asciidoc | 136 ++++++++
 ...-executed-with-short-program-name.asciidoc | 134 ++++++++
 ...roker-on-behalf-of-principal-user.asciidoc | 167 +++++++++
 ...us-antimalware-scan-interface-dll.asciidoc | 171 ++++++++++
 ...s-communication-app-child-process.asciidoc | 316 ++++++++++++++++++
 ...rsistence-or-privilege-escalation.asciidoc | 235 +++++++++++++
 ...-endpoint-security-parent-process.asciidoc | 149 +++++++++
 ...uspicious-kernel-feature-activity.asciidoc |  93 ++++++
 ...t-365-userloggedin-via-oauth-code.asciidoc | 136 ++++++++
 ...11-suspicious-named-pipe-creation.asciidoc | 111 ++++++
 ...e-8-17-11-suspicious-path-mounted.asciidoc | 101 ++++++
 ...11-suspicious-proc-maps-discovery.asciidoc | 154 +++++++++
 ...ion-via-renamed-psexec-executable.asciidoc | 130 +++++++
 ...suspicious-renaming-of-esxi-files.asciidoc | 154 +++++++++
 ...-renaming-of-esxi-index-html-file.asciidoc | 153 +++++++++
 ...creenconnect-client-child-process.asciidoc | 142 ++++++++
 ...-11-system-binary-moved-or-copied.asciidoc | 191 +++++++++++
 ...ry-symlink-to-suspicious-location.asciidoc |  77 +++++
 ...hreat-intel-email-indicator-match.asciidoc | 127 +++++++
 ...threat-intel-hash-indicator-match.asciidoc | 138 ++++++++
 ...-intel-ip-address-indicator-match.asciidoc | 140 ++++++++
 ...-threat-intel-url-indicator-match.asciidoc | 143 ++++++++
 ...-windows-registry-indicator-match.asciidoc | 133 ++++++++
 ...ia-windows-directory-masquerading.asciidoc | 169 ++++++++++
 ...rom-kernel-thread-kthreadd-parent.asciidoc | 119 +++++++
 ...17-11-unusual-exim4-child-process.asciidoc |  70 ++++
 ...brary-path-command-line-arguments.asciidoc | 132 ++++++++
 ...vity-from-a-windows-system-binary.asciidoc | 214 ++++++++++++
 ...twork-computing-from-the-internet.asciidoc | 155 +++++++++
 ...network-computing-to-the-internet.asciidoc | 148 ++++++++
 ...dbox-with-sensitive-configuration.asciidoc |  81 +++++
 .../prebuilt-rules-8-17-11-appendix.asciidoc  |  86 +++++
 .../prebuilt-rules-8-17-11-summary.asciidoc   | 172 ++++++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |   5 +
 .../prebuilt-rules-reference.asciidoc         | 178 +++++++---
 .../prebuilt-rules/rule-desc-index.asciidoc   |  46 ++-
 ...to-establish-vscode-remote-tunnel.asciidoc |   4 +-
 ...tic-site-javascript-file-uploaded.asciidoc | 148 ++++++++
 ...ce-against-microsoft-365-accounts.asciidoc |   5 +-
 .../browser-extension-install.asciidoc        |   4 +-
 ...n-to-commonly-abused-web-services.asciidoc |  16 +-
 ...lt-strike-team-server-certificate.asciidoc |   6 +-
 .../docker-release-file-creation.asciidoc     |  62 ++++
 ...om-unusual-directory-command-line.asciidoc |   4 +-
 ...used-remote-access-tool-execution.asciidoc |   4 +-
 ...-download-to-suspicious-directory.asciidoc | 114 +++++++
 .../linux-telegram-api-request.asciidoc       | 114 +++++++
 ...using-a-known-sunburst-dns-domain.asciidoc |   6 +-
 ...emory-dumping-via-proc-filesystem.asciidoc | 112 +++++++
 ...very-via-etc-exports-or-etc-fstab.asciidoc | 103 ++++++
 ...ing-via-visual-studio-code-client.asciidoc | 137 ++++++++
 ...e-registration-for-user-principal.asciidoc | 121 +++++++
 ...-sign-in-from-a-suspicious-source.asciidoc | 128 +++++++
 ...ld-engine-using-an-alternate-name.asciidoc |   4 +-
 ...gn-ins-with-suspicious-properties.asciidoc | 121 +++++++
 ...ing-via-visual-studio-code-client.asciidoc | 138 ++++++++
 ...tion-anonymized-ip-risk-detection.asciidoc | 128 +++++++
 ...ntra-id-service-principal-created.asciidoc | 141 ++++++++
 ...or-user-principal-via-auth-broker.asciidoc | 136 ++++++++
 ...irst-occurrence-of-client-request.asciidoc | 123 +++++++
 ...otection-alerts-by-user-principal.asciidoc | 120 +++++++
 ...ckdoor-execution-through-pam-exec.asciidoc |  80 +++++
 ...al-data-exfiltration-through-curl.asciidoc | 114 +++++++
 ...ruction-via-environment-variables.asciidoc | 113 +++++++
 ...ayload-execution-via-command-line.asciidoc | 124 +++++++
 ...load-execution-via-common-utility.asciidoc | 186 +++++++++++
 ...or-port-forwarding-via-ssh-option.asciidoc | 110 ++++++
 ...l-masquerading-as-browser-process.asciidoc |   4 +-
 ...erading-as-business-app-installer.asciidoc |   4 +-
 ...asquerading-as-communication-apps.asciidoc |   4 +-
 ...tial-masquerading-as-system32-dll.asciidoc |   6 +-
 ...squerading-as-system32-executable.asciidoc |   4 +-
 ...potential-masquerading-as-vlc-dll.asciidoc |   4 +-
 ...cktick-escaped-variable-expansion.asciidoc | 113 +++++++
 ...ia-character-array-reconstruction.asciidoc | 112 +++++++
 ...enated-dynamic-command-invocation.asciidoc | 109 ++++++
 ...high-numeric-character-proportion.asciidoc | 116 +++++++
 ...high-special-character-proportion.asciidoc | 118 +++++++
 ...tion-via-invalid-escape-sequences.asciidoc | 112 +++++++
 ...-obfuscation-via-reverse-keywords.asciidoc | 112 +++++++
 ...ion-via-special-character-overuse.asciidoc | 116 +++++++
 ...uscation-via-string-concatenation.asciidoc | 113 +++++++
 ...-process-name-stomping-with-prctl.asciidoc |   4 +-
 ...indows-error-manager-masquerading.asciidoc |   4 +-
 ...ia-negative-index-string-reversal.asciidoc | 116 +++++++
 ...ecution-from-an-unusual-directory.asciidoc |   4 +-
 ...gram-files-directory-masquerading.asciidoc |   4 +-
 ...7-threat-command-cves-correlation.asciidoc |   6 +-
 .../rare-connection-to-webdav-target.asciidoc | 105 ++++++
 .../remote-file-copy-via-teamviewer.asciidoc  |   4 +-
 ...enamed-autoit-scripts-interpreter.asciidoc |   4 +-
 ...-executed-with-short-program-name.asciidoc |   4 +-
 ...roker-on-behalf-of-principal-user.asciidoc | 167 +++++++++
 ...us-antimalware-scan-interface-dll.asciidoc |   4 +-
 ...s-communication-app-child-process.asciidoc |   4 +-
 ...rsistence-or-privilege-escalation.asciidoc |   4 +-
 ...-endpoint-security-parent-process.asciidoc |   4 +-
 ...uspicious-kernel-feature-activity.asciidoc |  93 ++++++
 ...t-365-userloggedin-via-oauth-code.asciidoc | 136 ++++++++
 .../suspicious-named-pipe-creation.asciidoc   | 111 ++++++
 .../suspicious-outlook-child-process.asciidoc |   4 +-
 .../suspicious-path-mounted.asciidoc          | 101 ++++++
 .../suspicious-proc-maps-discovery.asciidoc   |  15 +-
 ...ion-via-renamed-psexec-executable.asciidoc |   4 +-
 ...suspicious-renaming-of-esxi-files.asciidoc |   4 +-
 ...-renaming-of-esxi-index-html-file.asciidoc |   4 +-
 ...creenconnect-client-child-process.asciidoc |   4 +-
 .../system-binary-moved-or-copied.asciidoc    |   4 +-
 ...ry-symlink-to-suspicious-location.asciidoc |  77 +++++
 ...hreat-intel-email-indicator-match.asciidoc |   6 +-
 ...threat-intel-hash-indicator-match.asciidoc |   6 +-
 ...-intel-ip-address-indicator-match.asciidoc |   6 +-
 .../threat-intel-url-indicator-match.asciidoc |   6 +-
 ...-windows-registry-indicator-match.asciidoc |   6 +-
 ...ia-windows-directory-masquerading.asciidoc |   4 +-
 ...d-dll-loaded-by-a-trusted-process.asciidoc |   4 +-
 ...rom-kernel-thread-kthreadd-parent.asciidoc | 119 +++++++
 .../unusual-exim4-child-process.asciidoc      |  70 ++++
 ...brary-path-command-line-arguments.asciidoc | 132 ++++++++
 ...vity-from-a-windows-system-binary.asciidoc |   4 +-
 ...twork-computing-from-the-internet.asciidoc |   4 +-
 ...network-computing-to-the-internet.asciidoc |   4 +-
 ...dbox-with-sensitive-configuration.asciidoc |  81 +++++
 docs/index.asciidoc                           |   2 +
 173 files changed, 16935 insertions(+), 154 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-browser-extension-install.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-docker-release-file-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-linux-telegram-api-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-program-files-directory-masquerading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rare-connection-to-webdav-target.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-communication-app-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-kernel-feature-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-named-pipe-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-path-mounted.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-proc-maps-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-moved-or-copied.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-email-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-hash-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-url-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-exim4-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/docker-release-file-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/git-repository-or-file-download-to-suspicious-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/linux-telegram-api-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/manual-memory-dumping-via-proc-filesystem.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-service-principal-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-backdoor-execution-through-pam-exec.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-through-curl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-common-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-special-character-proportion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-reverse-keywords.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-special-character-overuse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-string-concatenation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/powershell-obfuscation-via-negative-index-string-reversal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/rare-connection-to-webdav-target.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-kernel-feature-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-named-pipe-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-path-mounted.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-binary-symlink-to-suspicious-location.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-exim4-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/windows-sandbox-with-sensitive-configuration.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel.asciidoc
new file mode 100644
index 0000000000..0b8a6d137a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel.asciidoc
@@ -0,0 +1,127 @@
+[[prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel]]
+=== Attempt to Establish VScode Remote Tunnel
+
+Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://badoption.eu/blog/2023/01/31/code_c2.html
+* https://code.visualstudio.com/docs/remote/tunnels
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Windows Security Event Logs
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Attempt to Establish VScode Remote Tunnel*
+
+
+Visual Studio Code (VScode) offers a remote tunnel feature enabling developers to connect to remote environments seamlessly. While beneficial for legitimate remote development, adversaries can exploit this to establish unauthorized access or control over systems. The detection rule identifies suspicious use of VScode's tunnel command, focusing on specific command-line arguments and process behaviors, to flag potential misuse indicative of command and control activities.
+
+
+*Possible investigation steps*
+
+
+- Review the process details to confirm the presence of the "tunnel" argument in the command line, which indicates an attempt to establish a remote tunnel session.
+- Check the parent process name to ensure it is not "Code.exe" when the process name is "code-tunnel.exe" with the "status" argument, as this is an exception in the rule.
+- Investigate the origin of the process by examining the user account and machine from which the process was initiated to determine if it aligns with expected usage patterns.
+- Analyze network logs to identify any unusual or unauthorized connections to GitHub or remote VScode instances that may suggest malicious activity.
+- Correlate the event with other security alerts or logs from data sources like Elastic Endgame, Sysmon, or Microsoft Defender for Endpoint to gather additional context on the activity.
+- Assess the risk and impact by determining if the system or user account has been involved in previous suspicious activities or if there are any indicators of compromise.
+
+
+*False positive analysis*
+
+
+- Legitimate remote development activities using VScode's tunnel feature may trigger the rule. Users can create exceptions for known developer machines or specific user accounts frequently using this feature for authorized purposes.
+- Automated scripts or deployment tools that utilize VScode's remote tunnel for legitimate operations might be flagged. Consider excluding these processes by identifying their unique command-line arguments or parent processes.
+- Scheduled tasks or system maintenance activities that involve VScode's remote capabilities could be misidentified as threats. Review and whitelist these tasks by their specific execution times or associated service accounts.
+- Development environments that frequently update or test VScode extensions might inadvertently match the rule's criteria. Exclude these environments by setting up exceptions based on their network segments or IP addresses.
+- Training or demonstration sessions using VScode's remote features for educational purposes can be mistaken for suspicious activity. Implement exclusions for these sessions by tagging them with specific event identifiers or user roles.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
+- Terminate any suspicious VScode processes identified by the detection rule to halt potential command and control activities.
+- Conduct a thorough review of system logs and process histories to identify any additional indicators of compromise or lateral movement attempts.
+- Reset credentials and access tokens associated with the affected system and any connected services to mitigate unauthorized access.
+- Restore the system from a known good backup if any unauthorized changes or malware are detected.
+- Implement network segmentation to limit the ability of similar threats to spread across the environment.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : "tunnel" and (process.args : "--accept-server-license-terms" or process.name : "code*.exe") and
+  not (process.name == "code-tunnel.exe" and process.args == "status" and process.parent.name == "Code.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded.asciidoc
new file mode 100644
index 0000000000..e1c18f7028
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded]]
+=== AWS S3 Static Site JavaScript File Uploaded
+
+This rule detects when a JavaScript file is uploaded or accessed in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/
+* https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html
+* https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS S3
+* Tactic: Impact
+* Use Case: Web Application Compromise
+* Use Case: Cloud Threat Detection
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS S3 Static Site JavaScript File Uploaded*
+
+
+An S3 `PutObject` action that targets a path like `static/js/` and uploads a `.js` file is a potential signal for web content modification. If done by an unexpected IAM user or outside of CI/CD workflows, it may indicate a compromise.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Source User**: Check `aws.cloudtrail.user_identity.arn`, access key ID, and session type (`IAMUser`, `AssumedRole`, etc).
+- **Review File Content**: Use the S3 `GetObject` or CloudTrail `requestParameters` to inspect the uploaded file for signs of obfuscation or injection.
+- **Correlate to Other Events**: Review events from the same IAM user before and after the upload (e.g., `ListBuckets`, `GetCallerIdentity`, IAM activity).
+- **Look for Multiple Uploads**: Attackers may attempt to upload several files or modify multiple directories.
+
+
+*False Positive Analysis*
+
+
+- This behavior may be expected during app deployments. Look at:
+  - The `user_agent.original` to detect legitimate CI tools (like Terraform or GitHub Actions).
+  - Timing patterns—does this match a regular release window?
+  - The origin IP and device identity.
+
+
+*Response and Remediation*
+
+
+- **Revert Malicious Code**: Replace the uploaded JS file with a clean version and invalidate CloudFront cache if applicable.
+- **Revoke Access**: If compromise is confirmed, revoke the IAM credentials and disable the user.
+- **Audit IAM Policies**: Ensure that only deployment users can modify static site buckets.
+- **Enable Bucket Versioning**: This can allow for quick rollback and historical review.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-aws.cloudtrail* metadata _id, _version, _index
+| where
+
+    // filter on CloudTrail logs for S3 PutObject actions
+    event.dataset == "aws.cloudtrail"
+    and event.provider == "s3.amazonaws.com"
+    and event.action in ("GetObject","PutObject")
+
+    // filter for IAM users, not federated identities
+    and aws.cloudtrail.user_identity.type in ("IAMUser", "AssumedRole")
+
+    // filter for S3 static site bucket paths from webpack or similar
+    and aws.cloudtrail.request_parameters LIKE "*static/js/*.js*"
+
+    // exclude common IaC tools and automation scripts
+    and not (
+        user_agent.original LIKE "*Terraform*"
+        or user_agent.original LIKE "*Ansible*"
+        or user_agent.original LIKE "*Pulumni*"
+    )
+
+// extract bucket and object details from request parameters
+| dissect aws.cloudtrail.request_parameters "%{{?bucket.name.key}=%{bucket.name}, %{?host.key}=%{bucket.host}, %{?bucket.object.location.key}=%{bucket.object.location}}"
+
+// filter for specific bucket and object structure
+| dissect bucket.object.location "%{}static/js/%{bucket.object}"
+
+// filter for JavaScript files
+| where ENDS_WITH(bucket.object, ".js")
+| keep
+    aws.cloudtrail.user_identity.arn,
+    aws.cloudtrail.user_identity.access_key_id,
+    aws.cloudtrail.user_identity.type,
+    aws.cloudtrail.request_parameters,
+    bucket.name,
+    bucket.object,
+    user_agent.original,
+    source.ip,
+    event.action,
+    @timestamp
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Manipulation
+** ID: T1565
+** Reference URL: https://attack.mitre.org/techniques/T1565/
+* Sub-technique:
+** Name: Stored Data Manipulation
+** ID: T1565.001
+** Reference URL: https://attack.mitre.org/techniques/T1565/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
new file mode 100644
index 0000000000..0a3336bd35
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
@@ -0,0 +1,139 @@
+[[prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts]]
+=== Azure Entra Sign-in Brute Force against Microsoft 365 Accounts
+
+Identifies potential brute-force attempts against Microsoft 365 user accounts by detecting a high number of failed interactive or non-interactive login attempts within a 30-minute window. Attackers may attempt to brute force user accounts to gain unauthorized access to Microsoft 365 services via different services such as Exchange, SharePoint, or Teams.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 10m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://cloud.hacktricks.xyz/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/az-password-spraying
+* https://github.com/0xZDH/o365spray
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Azure Entra Sign-in Brute Force against Microsoft 365 Accounts*
+
+
+Azure Entra ID, integral to Microsoft 365, manages user identities and access. Adversaries exploit this by attempting numerous login attempts to breach accounts, targeting services like Exchange and Teams. The detection rule identifies such threats by analyzing failed login patterns within a 30-minute window, flagging unusual activity from multiple sources or excessive failed attempts, thus highlighting potential brute-force attacks.
+
+
+*Possible investigation steps*
+
+
+- Review the `azure.signinlogs.properties.user_principal_name` to identify the specific user account targeted by the brute-force attempts.
+- Examine the `source.ip` field to determine the origin of the failed login attempts and assess if multiple IP addresses are involved, indicating a distributed attack.
+- Check the `azure.signinlogs.properties.resource_display_name` to understand which Microsoft 365 services (e.g., Exchange, SharePoint, Teams) were targeted during the login attempts.
+- Analyze the `target_time_window` to confirm the timeframe of the attack and correlate it with other security events or alerts that may have occurred simultaneously.
+- Investigate the `azure.signinlogs.properties.status.error_code` for specific error codes that might provide additional context on the nature of the failed login attempts.
+- Assess the user's recent activity and any changes in behavior or access patterns that could indicate a compromised account or insider threat.
+
+
+*False positive analysis*
+
+
+- High volume of legitimate login attempts from a single user can trigger false positives, especially during password resets or account recovery processes. To mitigate this, consider excluding known IP addresses associated with IT support or helpdesk operations.
+- Automated scripts or applications that frequently access Microsoft 365 services using non-interactive logins may be misidentified as brute force attempts. Identify and whitelist these applications by their user principal names or IP addresses.
+- Users traveling or working remotely may log in from multiple locations in a short period, leading to false positives. Implement geolocation-based exclusions for known travel patterns or use conditional access policies to manage these scenarios.
+- Bulk operations performed by administrators, such as batch account updates or migrations, can result in numerous failed logins. Exclude these activities by recognizing the specific user principal names or IP addresses involved in such operations.
+- Frequent logins from shared IP addresses, such as those from corporate VPNs or proxy servers, might be flagged. Consider excluding these IP ranges if they are known and trusted within the organization.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected user accounts by disabling them to prevent further unauthorized access.
+- Conduct a password reset for the compromised accounts, ensuring the new passwords are strong and unique.
+- Review and block the IP addresses associated with the failed login attempts to prevent further access attempts from these sources.
+- Enable multi-factor authentication (MFA) for the affected accounts and any other accounts that do not have it enabled to add an additional layer of security.
+- Monitor the affected accounts and related services for any unusual activity or signs of compromise post-remediation.
+- Escalate the incident to the security operations team for further investigation and to determine if there are broader implications or related threats.
+- Update and enhance detection rules and monitoring to identify similar brute-force attempts in the future, ensuring quick response to any new threats.
+
+This rule relies on Azure Entra ID sign-in logs, but filters for Microsoft 365 resources.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-azure.signinlogs*
+// truncate the timestamp to a 30-minute window
+| eval target_time_window = DATE_TRUNC(30 minutes, @timestamp)
+| WHERE
+  event.dataset == "azure.signinlogs"
+  and event.category == "authentication"
+  and to_lower(azure.signinlogs.properties.resource_display_name) rlike "(.*)365(.*)"
+  and azure.signinlogs.category in ("NonInteractiveUserSignInLogs", "SignInLogs")
+  and event.outcome != "success"
+  and not (azure.signinlogs.category == "NonInteractiveUserSignInLogs"
+      and azure.signinlogs.properties.status.error_code in (70043, 70044, 50057)
+      and azure.signinlogs.properties.incoming_token_type in ("primaryRefreshToken", "refreshToken")) 
+  // for tuning review azure.signinlogs.properties.status.error_code
+  // https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
+
+// keep only relevant fields
+| keep target_time_window, event.dataset, event.category, azure.signinlogs.properties.resource_display_name, azure.signinlogs.category, event.outcome, azure.signinlogs.properties.user_principal_name, source.ip
+
+// count the number of login sources and failed login attempts
+| stats
+  login_source_count = count(source.ip),
+  failed_login_count = count(*) by target_time_window, azure.signinlogs.properties.user_principal_name
+
+// filter for users with more than 20 login sources or failed login attempts
+| where (login_source_count >= 20 or failed_login_count >= 20)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-browser-extension-install.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-browser-extension-install.asciidoc
new file mode 100644
index 0000000000..df4e72e95d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-browser-extension-install.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-17-11-browser-extension-install]]
+=== Browser Extension Install
+
+Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: SentinelOne
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Resources: Investigation Guide
+
+*Version*: 206
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Browser Extension Install*
+
+Browser extensions enhance functionality in web browsers but can be exploited by adversaries to gain persistence or execute malicious activities. Attackers may disguise harmful extensions as legitimate or use compromised systems to install them. The detection rule identifies suspicious extension installations by monitoring file creation events in typical extension directories, filtering out known safe processes, and focusing on Windows environments.
+
+
+*Possible investigation steps*
+
+
+- Review the file creation event details to identify the specific browser extension file (e.g., .xpi or .crx) and its path to determine if it aligns with known malicious patterns or locations.
+- Check the process that initiated the file creation event, especially if it is not a known safe process like firefox.exe, to assess if it is a legitimate application or potentially malicious.
+- Investigate the user account associated with the file creation event to determine if the activity is expected or if the account may have been compromised.
+- Examine recent system activity and logs for any signs of social engineering attempts or unauthorized access that could have led to the installation of the extension.
+- Cross-reference the extension file name and path with threat intelligence sources to identify if it is associated with known malicious browser extensions.
+- If applicable, review the browser's extension management interface to verify the presence and legitimacy of the installed extension.
+
+
+*False positive analysis*
+
+
+- Language pack installations for Firefox can trigger false positives. Exclude files named "langpack-*@firefox.mozilla.org.xpi" from detection to prevent unnecessary alerts.
+- Dictionary add-ons for Firefox may also be flagged. Add exceptions for files named "*@dictionaries.addons.mozilla.org.xpi" to reduce false positives.
+- Regular updates or installations of legitimate browser extensions from trusted sources can be mistaken for malicious activity. Maintain a list of trusted processes and paths to exclude from monitoring.
+- User-initiated installations from official browser stores might be flagged. Educate users on safe installation practices and consider excluding known safe processes like "firefox.exe" when associated with legitimate extension paths.
+- Frequent installations in enterprise environments due to software deployment tools can cause alerts. Coordinate with IT to identify and exclude these routine activities from detection.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread or communication with potential command and control servers.
+- Terminate any suspicious processes associated with the unauthorized browser extension installation, such as unknown or unexpected instances of browser processes.
+- Remove the malicious browser extension by deleting the associated files from the extension directories identified in the alert.
+- Conduct a full antivirus and anti-malware scan on the affected system to identify and remove any additional threats or remnants of the malicious extension.
+- Review and reset browser settings to default to ensure no residual configurations or settings are left by the malicious extension.
+- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
+- Implement application whitelisting to prevent unauthorized browser extensions from being installed in the future, focusing on the directories and file types identified in the detection query.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type : "creation" and
+(
+  /* Firefox-Based Browsers */
+  (
+    file.name : "*.xpi" and
+    file.path : "?:\\Users\\*\\AppData\\Roaming\\*\\Profiles\\*\\Extensions\\*.xpi" and
+    not
+    (
+      process.name : "firefox.exe" and
+      file.name : ("langpack-*@firefox.mozilla.org.xpi", "*@dictionaries.addons.mozilla.org.xpi")
+    )
+  ) or
+  /* Chromium-Based Browsers */
+  (
+    file.name : "*.crx" and
+    file.path : "?:\\Users\\*\\AppData\\Local\\*\\*\\User Data\\Webstore Downloads\\*"
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Software Extensions
+** ID: T1176
+** Reference URL: https://attack.mitre.org/techniques/T1176/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services.asciidoc
new file mode 100644
index 0000000000..4dd661b35d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services.asciidoc
@@ -0,0 +1,312 @@
+[[prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services]]
+=== Connection to Commonly Abused Web Services
+
+Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/operation-bleeding-bear
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 120
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Connection to Commonly Abused Web Services*
+
+
+Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
+
+This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Verify whether the digital signature exists in the executable.
+- Identify the operation type (upload, download, tunneling, etc.).
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+    process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+    /* Add new WebSvc domains here */
+    dns.question.name :
+       (
+        "raw.githubusercontent.*",
+        "pastebin.*",
+        "paste4btc.com",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "?.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "*.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "apis.azureedge.net",
+        "cdn.sql.gg",
+        "?.top4top.io",
+        "top4top.io",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "gofile.io",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "t.me",
+        "meacz.gq",
+        "rwrd.org",
+        "*.publicvm.com",
+        "*.blogspot.com",
+        "api.mylnikov.org",
+        "file.io",
+        "stackoverflow.com",
+        "*files.1drv.com",
+        "api.anonfile.com",
+        "*hosting-profi.de",
+        "ipbase.com",
+        "ipfs.io",
+        "*up.freeo*.space",
+        "api.mylnikov.org",
+        "script.google.com",
+        "script.googleusercontent.com",
+        "api.notion.com",
+        "graph.microsoft.com",
+        "*.sharepoint.com",
+        "mbasic.facebook.com",
+        "login.live.com",
+        "api.gofile.io",
+        "api.anonfiles.com",
+        "api.notion.com",
+        "api.trello.com",
+        "gist.githubusercontent.com",
+        "files.pythonhosted.org",
+        "g.live.com",
+        "*.zulipchat.com",
+        "webhook.site",
+        "run.mocky.io",
+        "mockbin.org", 
+        "www.googleapis.com", 
+        "googleapis.com",
+        "global.rel.tunnels.api.visualstudio.com",
+        "*.devtunnels.ms", 
+        "api.github.com") and
+        
+    /* Insert noisy false positives here */
+    not (
+      (
+        process.executable : (
+          "?:\\Program Files\\*.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\Windows\\system32\\svchost.exe",
+          "?:\\Windows\\System32\\WWAHost.exe",
+          "?:\\Windows\\System32\\smartscreen.exe",
+          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
+          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
+          "?:\\Users\\*\\AppData\\Local\\PowerToys\\PowerToys.exe",
+          "?:\\Windows\\system32\\mobsync.exe",
+          "?:\\Windows\\SysWOW64\\mobsync.exe", 
+          "?:\\Windows\\System32\\wsl.exe", 
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe"
+        )
+      ) or
+    
+      /* Discord App */
+      (process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
+      ) or 
+
+      /* MS Sharepoint */
+      (process.name : "Microsoft.SharePoint.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
+       process.code_signature.trusted == true) and dns.question.name : "onedrive.live.com"
+      ) or 
+
+      /* Firefox */
+      (process.name : "firefox.exe" and (process.code_signature.subject_name : "Mozilla Corporation" and
+       process.code_signature.trusted == true)
+      ) or 
+
+      /* Dropbox */
+      (process.name : "Dropbox.exe" and (process.code_signature.subject_name : "Dropbox, Inc" and
+       process.code_signature.trusted == true) and dns.question.name : ("api.dropboxapi.com", "*.dropboxusercontent.com")
+      ) or 
+
+      /* Obsidian - Plugins are stored on raw.githubusercontent.com */
+      (process.name : "Obsidian.exe" and (process.code_signature.subject_name : "Dynalist Inc" and
+       process.code_signature.trusted == true) and dns.question.name : "raw.githubusercontent.com"
+      ) or 
+
+      /* WebExperienceHostApp */
+      (process.name : "WebExperienceHostApp.exe" and (process.code_signature.subject_name : "Microsoft Windows" and
+       process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com")
+      ) or
+
+      (process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true and
+       dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com", "login.live.com")) or
+
+      (process.code_signature.trusted == true and
+       process.code_signature.subject_name :
+                             ("Johannes Schindelin",
+                              "Redis Inc.",
+                              "Slack Technologies, LLC",
+                              "Cisco Systems, Inc.",
+                              "Dropbox, Inc",
+                              "Amazon.com Services LLC", 
+                              "Island Technology Inc.", 
+                              "GitHub, Inc.", 
+                              "Red Hat, Inc"))
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Web Service
+** ID: T1102
+** Reference URL: https://attack.mitre.org/techniques/T1102/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Sub-technique:
+** Name: Exfiltration to Code Repository
+** ID: T1567.001
+** Reference URL: https://attack.mitre.org/techniques/T1567/001/
+* Sub-technique:
+** Name: Exfiltration to Cloud Storage
+** ID: T1567.002
+** Reference URL: https://attack.mitre.org/techniques/T1567/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate.asciidoc
new file mode 100644
index 0000000000..fbec12bb0d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate]]
+=== Default Cobalt Strike Team Server Certificate
+
+This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/software/S0154/
+* https://www.cobaltstrike.com/help-setup-collaboration
+* https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html
+* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html
+* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-zeek.html
+* https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Threat: Cobalt Strike
+* Use Case: Threat Detection
+* Domain: Endpoint
+* Resources: Investigation Guide
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Default Cobalt Strike Team Server Certificate*
+
+
+Cobalt Strike is a tool used for simulating advanced cyber threats, often employed by security teams to test defenses. However, adversaries can exploit its default server certificate to establish covert command and control channels. The detection rule identifies this misuse by monitoring network traffic for specific cryptographic hashes associated with the default certificate, flagging potential unauthorized Cobalt Strike activity.
+
+
+*Possible investigation steps*
+
+
+- Review the network traffic logs to identify any connections associated with the specific cryptographic hashes: MD5 (950098276A495286EB2A2556FBAB6D83), SHA1 (6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C), or SHA256 (87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C).
+- Identify the source and destination IP addresses involved in the flagged network traffic to determine the potential origin and target of the Cobalt Strike activity.
+- Correlate the identified IP addresses with known assets in the network to assess if any internal systems are potentially compromised.
+- Check for any other suspicious or anomalous network activities around the same time as the alert to identify potential lateral movement or additional command and control channels.
+- Investigate any associated processes or user accounts on the involved systems to determine if there are signs of compromise or unauthorized access.
+- Review historical data to see if there have been previous alerts or similar activities involving the same cryptographic hashes or IP addresses, which might indicate a persistent threat.
+
+
+*False positive analysis*
+
+
+- Legitimate security testing activities by internal teams using Cobalt Strike may trigger the rule. Coordinate with security teams to whitelist known testing IP addresses or certificate hashes.
+- Some commercial penetration testing services may use Cobalt Strike with default certificates. Verify the legitimacy of such services and exclude their traffic from detection by adding their certificate hashes to an exception list.
+- Network appliances or security tools that simulate adversary behavior for training purposes might use similar certificates. Identify these tools and configure exceptions for their specific network traffic patterns.
+- In environments where Cobalt Strike is used for authorized red team exercises, ensure that the default certificate is replaced with a custom one to avoid false positives.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further communication with the potential Cobalt Strike server.
+- Conduct a thorough forensic analysis of the isolated system to identify any malicious payloads or additional indicators of compromise.
+- Revoke any compromised credentials and enforce a password reset for affected accounts to prevent unauthorized access.
+- Update and patch all systems to the latest security standards to mitigate vulnerabilities that could be exploited by similar threats.
+- Implement network segmentation to limit the lateral movement of threats within the network.
+- Enhance monitoring and logging to capture detailed network traffic and endpoint activity, focusing on the identified cryptographic hashes.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and coordination with external threat intelligence sources if necessary.
+
+
+*Threat intel*
+
+
+While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, so alerts should be investigated rapidly.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.tls or event.category: (network or network_traffic))
+  and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83
+  or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C
+  or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-docker-release-file-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-docker-release-file-creation.asciidoc
new file mode 100644
index 0000000000..dc21fe3d25
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-docker-release-file-creation.asciidoc
@@ -0,0 +1,62 @@
+[[prebuilt-rule-8-17-11-docker-release-file-creation]]
+=== Docker Release File Creation
+
+This rule detects the creation of files named release_agent or notify_on_release, which are commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host from within a container.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/
+
+*Tags*: 
+
+* Domain: Endpoint
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and file.name in ("release_agent", "notify_on_release")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Escape to Host
+** ID: T1611
+** Reference URL: https://attack.mitre.org/techniques/T1611/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line.asciidoc
new file mode 100644
index 0000000000..3047c474fb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line.asciidoc
@@ -0,0 +1,263 @@
+[[prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line]]
+=== Execution from Unusual Directory - Command Line
+
+Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper
+* https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+
+*Version*: 319
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Execution from Unusual Directory - Command Line*
+
+
+This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine which commands or scripts were executed.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of parent process executable and command line conditions.
+
+
+*Related rules*
+
+
+- Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wscript.exe",
+                  "cscript.exe",
+                  "rundll32.exe",
+                  "regsvr32.exe",
+                  "cmstp.exe",
+                  "RegAsm.exe",
+                  "installutil.exe",
+                  "mshta.exe",
+                  "RegSvcs.exe",
+                  "powershell.exe",
+                  "pwsh.exe",
+                  "cmd.exe") and
+
+  /* add suspicious execution paths here */
+  process.args : ("C:\\PerfLogs\\*",
+                  "C:\\Users\\Public\\*",
+                  "C:\\Windows\\Tasks\\*",
+                  "C:\\Intel\\*",
+                  "C:\\AMD\\Temp\\*",
+                  "C:\\Windows\\AppReadiness\\*",
+                  "C:\\Windows\\ServiceState\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\IdentityCRL\\*",
+                  "C:\\Windows\\Branding\\*",
+                  "C:\\Windows\\csc\\*",
+                  "C:\\Windows\\DigitalLocker\\*",
+                  "C:\\Windows\\en-US\\*",
+                  "C:\\Windows\\wlansvc\\*",
+                  "C:\\Windows\\Prefetch\\*",
+                  "C:\\Windows\\Fonts\\*",
+                  "C:\\Windows\\diagnostics\\*",
+                  "C:\\Windows\\TAPI\\*",
+                  "C:\\Windows\\INF\\*",
+                  "C:\\Windows\\System32\\Speech\\*",
+                  "C:\\windows\\tracing\\*",
+                  "c:\\windows\\IME\\*",
+                  "c:\\Windows\\Performance\\*",
+                  "c:\\windows\\intel\\*",
+                  "c:\\windows\\ms\\*",
+                  "C:\\Windows\\dot3svc\\*",
+                  "C:\\Windows\\panther\\*",
+                  "C:\\Windows\\RemotePackages\\*",
+                  "C:\\Windows\\OCR\\*",
+                  "C:\\Windows\\appcompat\\*",
+                  "C:\\Windows\\apppatch\\*",
+                  "C:\\Windows\\addins\\*",
+                  "C:\\Windows\\Setup\\*",
+                  "C:\\Windows\\Help\\*",
+                  "C:\\Windows\\SKB\\*",
+                  "C:\\Windows\\Vss\\*",
+                  "C:\\Windows\\servicing\\*",
+                  "C:\\Windows\\CbsTemp\\*",
+                  "C:\\Windows\\Logs\\*",
+                  "C:\\Windows\\WaaS\\*",
+                  "C:\\Windows\\twain_32\\*",
+                  "C:\\Windows\\ShellExperiences\\*",
+                  "C:\\Windows\\ShellComponents\\*",
+                  "C:\\Windows\\PLA\\*",
+                  "C:\\Windows\\Migration\\*",
+                  "C:\\Windows\\debug\\*",
+                  "C:\\Windows\\Cursors\\*",
+                  "C:\\Windows\\Containers\\*",
+                  "C:\\Windows\\Boot\\*",
+                  "C:\\Windows\\bcastdvr\\*",
+                  "C:\\Windows\\TextInput\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\schemas\\*",
+                  "C:\\Windows\\SchCache\\*",
+                  "C:\\Windows\\Resources\\*",
+                  "C:\\Windows\\rescache\\*",
+                  "C:\\Windows\\Provisioning\\*",
+                  "C:\\Windows\\PrintDialog\\*",
+                  "C:\\Windows\\PolicyDefinitions\\*",
+                  "C:\\Windows\\media\\*",
+                  "C:\\Windows\\Globalization\\*",
+                  "C:\\Windows\\L2Schemas\\*",
+                  "C:\\Windows\\LiveKernelReports\\*",
+                  "C:\\Windows\\ModemLogs\\*",
+                  "C:\\Windows\\ImmersiveControlPanel\\*",
+                  "C:\\$Recycle.Bin\\*") and
+
+  /* noisy FP patterns */
+
+  not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
+                                   "C:\\Windows\\System32\\spacedeskService.exe",
+                                   "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and
+  not (process.name : "rundll32.exe" and
+       process.args : ("uxtheme.dll,#64",
+                       "PRINTUI.DLL,PrintUIEntry",
+                       "?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog",
+                       "?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
+                       "?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and
+
+  not (process.name : "cscript.exe" and process.args : "?:\\WINDOWS\\system32\\calluxxprovider.vbs") and
+
+  not (process.name : "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe" and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and
+
+  not (process.name : "regsvr32.exe" and process.args : "?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and
+
+  not (process.name : "cmd.exe" and
+       process.parent.executable : ("?:\\Windows\\System32\\oobe\\windeploy.exe",
+                                    "?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
+                                    "?:\\Windows\\System32\\igfxCUIService.exe",
+                                    "?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
new file mode 100644
index 0000000000..7f3e609101
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -0,0 +1,313 @@
+[[prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution]]
+=== First Time Seen Commonly Abused Remote Access Tool Execution
+
+Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* endgame-*
+* winlogbeat-*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/
+* https://attack.mitre.org/techniques/T1219/
+* https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Windows Security Event Logs
+* Data Source: Sysmon
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen Commonly Abused Remote Access Tool Execution*
+
+
+Remote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.
+
+At the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.
+
+This rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Check if the execution of the remote access tool is approved by the organization's IT department.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+  - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+
+
+*False positive analysis*
+
+
+- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.
+- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type: "windows" and
+
+   event.category: "process" and event.type : "start" and
+
+    (
+        process.code_signature.subject_name : (
+            "Action1 Corporation" or
+            "AeroAdmin LLC" or
+            "Ammyy LLC" or
+            "Atera Networks Ltd" or
+            "AWERAY PTE. LTD." or
+            "BeamYourScreen GmbH" or
+            "Bomgar Corporation" or
+            "DUC FABULOUS CO.,LTD" or
+            "DOMOTZ INC." or
+            "DWSNET OÜ" or
+            "FleetDeck Inc" or
+            "GlavSoft LLC" or
+            "GlavSoft LLC." or
+            "Hefei Pingbo Network Technology Co. Ltd" or
+            "IDrive, Inc." or
+            "IMPERO SOLUTIONS LIMITED" or
+            "Instant Housecall" or
+            "ISL Online Ltd." or
+            "LogMeIn, Inc." or
+            "Monitoring Client" or
+            "MMSOFT Design Ltd." or
+            "Nanosystems S.r.l." or
+            "NetSupport Ltd" or
+            "NinjaRMM, LLC" or
+            "Parallels International GmbH" or
+            "philandro Software GmbH" or
+            "Pro Softnet Corporation" or
+            "RealVNC" or
+            "RealVNC Limited" or
+            "BreakingSecurity.net" or
+            "Remote Utilities LLC" or
+            "Rocket Software, Inc." or
+            "SAFIB" or
+            "Servably, Inc." or
+            "ShowMyPC INC" or
+            "Splashtop Inc." or
+            "Superops Inc." or
+            "TeamViewer" or
+            "TeamViewer GmbH" or
+            "TeamViewer Germany GmbH" or
+            "Techinline Limited" or
+            "uvnc bvba" or
+            "Yakhnovets Denis Aleksandrovich IP" or
+            "Zhou Huabing"
+        ) or
+
+        process.name.caseless : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        ) or
+        process.name : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        )
+	) and
+
+	not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory.asciidoc
new file mode 100644
index 0000000000..25e462b442
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory.asciidoc
@@ -0,0 +1,114 @@
+[[prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory]]
+=== Git Repository or File Download to Suspicious Directory
+
+This rule detects the use of git to clone a repository or download files from GitHub using wget or curl, followed by the creation of files in suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior may indicate an attempt to download a payload, exploit or tool.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id, host.id with maxspan=10s
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
+     (process.name == "git" and process.args == "clone") or
+     (process.name in ("wget", "curl") and process.command_line like~ "*github*")
+  )]
+  [file where host.os.type == "linux" and event.type == "creation" and file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-linux-telegram-api-request.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-linux-telegram-api-request.asciidoc
new file mode 100644
index 0000000000..721d5c2d09
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-linux-telegram-api-request.asciidoc
@@ -0,0 +1,114 @@
+[[prebuilt-rule-8-17-11-linux-telegram-api-request]]
+=== Linux Telegram API Request
+
+This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.name in ("curl", "wget") and process.command_line like "*api.telegram.org*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
new file mode 100644
index 0000000000..59b69f821c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain]]
+=== Machine Learning Detected DGA activity using a known SUNBURST DNS domain
+
+A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/dga
+* https://www.elastic.co/security-labs/detect-domain-generation-algorithm-activity-with-new-kibana-integration
+
+*Tags*: 
+
+* Domain: Network
+* Domain: Endpoint
+* Data Source: Elastic Defend
+* Use Case: Domain Generation Algorithm Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Command and Control
+* Resources: Investigation Guide
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Machine Learning Detected DGA activity using a known SUNBURST DNS domain*
+
+
+Domain Generation Algorithms (DGAs) are used by adversaries to dynamically generate domain names for command and control (C2) communication, making it difficult to block malicious domains. The SUNBURST malware utilized such techniques. The detection rule leverages machine learning to identify DNS queries linked to these generated domains, specifically targeting those associated with SUNBURST, by analyzing patterns and predicting malicious activity, thus aiding in early threat detection and mitigation.
+
+
+*Possible investigation steps*
+
+
+- Review the DNS logs to identify the source IP address associated with the DNS query for avsvmcloud.com to determine the affected host within the network.
+- Check historical DNS query logs for the identified host to see if there are additional queries to other suspicious or known malicious domains, indicating further compromise.
+- Investigate the network traffic from the identified host around the time of the alert to detect any unusual patterns or connections to external IP addresses that may suggest command and control activity.
+- Examine endpoint security logs and alerts for the affected host to identify any signs of SUNBURST malware or other related malicious activity.
+- Correlate the alert with other security events in the environment to determine if there are any related incidents or patterns that could indicate a broader attack campaign.
+- Assess the risk and impact of the detected activity on the organization and determine if immediate containment or remediation actions are necessary.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or network services may occasionally use domain generation algorithms for load balancing or redundancy, leading to false positives. Users should monitor and whitelist these known benign services.
+- Internal testing environments or security tools that simulate DGA behavior for research or training purposes might trigger alerts. Exclude these environments by adding them to an exception list.
+- Some cloud services might use dynamic DNS techniques that resemble DGA patterns. Identify and document these services, then configure exceptions to prevent unnecessary alerts.
+- Frequent legitimate access to avsvmcloud.com by security researchers or analysts could be misclassified. Ensure these activities are logged and reviewed, and create exceptions for known research IPs or user accounts.
+- Regularly review and update the exception list to ensure it reflects current network behavior and does not inadvertently allow new threats.
+
+
+*Response and remediation*
+
+
+- Isolate the affected systems immediately to prevent further communication with the malicious domain avsvmcloud.com and halt potential data exfiltration or lateral movement.
+- Conduct a thorough scan of the isolated systems using updated antivirus and anti-malware tools to identify and remove any SUNBURST malware or related malicious files.
+- Review and block any outbound traffic to the domain avsvmcloud.com at the network perimeter to prevent future connections from other potentially compromised systems.
+- Analyze network logs and DNS query records to identify any other systems that may have communicated with the domain, and apply the same isolation and scanning procedures to those systems.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the compromise.
+- Implement enhanced monitoring and alerting for any DNS queries or network traffic patterns indicative of DGA activity, particularly those resembling SUNBURST characteristics, to detect and respond to similar threats promptly.
+- Review and update incident response and recovery plans to incorporate lessons learned from this incident, ensuring faster and more effective responses to future threats.
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Domain Generation Algorithm (DGA) Detection integration assets to be installed, as well as DNS events collected by integrations such as Elastic Defend, Network Packet Capture, or Packetbeat.
+
+
+*DGA Detection Setup*
+
+The DGA Detection integration consists of an ML-based framework to detect DGA activity in DNS events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for DGA Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- DNS events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend], https://docs.elastic.co/integrations/network_traffic[Network Packet Capture] integration, or https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-overview.html[Packetbeat].
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To add the Network Packet Capture integration to an Elastic Agent policy, refer to https://www.elastic.co/guide/en/fleet/current/add-integration-to-policy.html[this] guide.
+- To set up and run Packetbeat, follow https://www.elastic.co/guide/en/beats/packetbeat/current/setting-up-and-running.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the DGA Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Domain Generation Algorithm Detection and select the integration to see more details about it.
+- Follow the instructions under the **Installation** section.
+- For this rule to work, complete the instructions through **Configure the ingest pipeline**.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+ml_is_dga.malicious_prediction:1 and dns.question.registered_domain:avsvmcloud.com
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem.asciidoc
new file mode 100644
index 0000000000..37d9cd3507
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem]]
+=== Manual Memory Dumping via Proc Filesystem
+
+This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.command_line like "/proc/*/mem"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Proc Filesystem
+** ID: T1003.007
+** Reference URL: https://attack.mitre.org/techniques/T1003/007/
+* Technique:
+** Name: Exploitation for Credential Access
+** ID: T1212
+** Reference URL: https://attack.mitre.org/techniques/T1212/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
new file mode 100644
index 0000000000..a45e419002
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
@@ -0,0 +1,103 @@
+[[prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab]]
+=== Manual Mount Discovery via /etc/exports or /etc/fstab
+
+This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this file to gather information about shared directories and potential targets for further exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.command_line like ("/etc/exports", "/etc/fstab")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
new file mode 100644
index 0000000000..23094d3962
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -0,0 +1,137 @@
+[[prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client]]
+=== Microsoft 365 OAuth Phishing via Visual Studio Code Client
+
+Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 OAuth Phishing via Visual Studio Code Client*
+
+
+This rule identifies successful Microsoft 365 sign-ins where the Visual Studio Code first-party application (`ApplicationId = aebc6443-996d-45c2-90f0-388ff96faa56`) was used to initiate an OAuth 2.0 authorization code flow targeting Microsoft Graph. While this is common for legitimate development workflows, it has been abused in real-world phishing campaigns to trick users into returning authorization codes that attackers can exchange for access tokens.
+
+The behavior is typically seen in targeted attacks where users are lured into clicking a Microsoft login URL that redirects to a legitimate Microsoft URI (such as `insiders.vscode.dev`) and displays an OAuth code. If the user returns this code (e.g., via Signal, WhatsApp, or email), the attacker can use it to gain access to the user’s data via Microsoft Graph APIs — all without prompting for explicit consent or MFA, especially when default or pre-consented apps are abused.
+
+
+*Possible investigation steps*
+
+
+- Review `user.name` or `o365.audit.UserId` to identify the impacted account.
+- Validate whether the user expected to authorize the Visual Studio Code app at the time of the event.
+- Check if `o365.audit.ActorIpAddress` is an unexpected or geolocated IP — especially outside of corporate ranges or from proxy networks.
+- Look at `user_agent.original` and `o365.audit.DeviceProperties` to determine the device and browser involved — known attacker flows often show Chrome + MacOS or headless browser variants.
+- Confirm the `Target.ID` (Microsoft Graph: `00000003-0000-0000-c000-000000000000`) matches the scope of access the attacker might attempt.
+- Check for follow-up access events or mailbox enumeration using the Graph API from unfamiliar service principals or devices.
+- Review the `ExtendedProperties.RequestType` = `OAuth2:Authorize` and `ResultStatusDetail` = `Redirect` — this indicates that the user was redirected after authorization, which typically exposes the OAuth `code`.
+
+
+*False positive analysis*
+
+
+- Developers or IT users intentionally using Visual Studio Code to connect to Microsoft 365 may trigger this rule.
+- Legitimate Visual Studio Code extensions that sync or query Graph API data (e.g., calendars, tasks, cloud-hosted notebooks).
+- Enterprise use cases where VS Code is used for integrated identity workflows.
+- Exclude known user agents and hosts that regularly use Visual Studio Code against Graph.
+- Whitelist specific source IPs or devices tied to developer machines.
+- Correlate with user context and behavior — if the user has no reason to be developing or testing code, the event may be more suspicious.
+- Add exception rules for managed devices or corporate laptops using this flow regularly.
+
+
+*Response and remediation*
+
+
+- Reach out to the user to confirm if they expected this login or may have shared an OAuth code.
+- Suspend or reset credentials if the login appears suspicious or if the code was likely returned to a third party.
+- Review recent Microsoft Graph activity (email, file access, Teams) for this user and service principal.
+- Block or restrict future use of OAuth tokens from unknown apps or IPs via Conditional Access.
+- Add alerts for `ApplicationId = aebc6443-...` combined with low-reputation IPs or unexpected device fingerprints.
+- Require MFA and Conditional Access for all OAuth flows — even for Microsoft first-party apps.
+- Disable or restrict app consent for users, and require admin approval for Graph API scopes.
+- Educate users about OAuth-based phishing techniques — especially those that ask users to share "codes" after clicking a Microsoft login link.
+- Regularly audit `ApplicationId`, `RequestType`, and `ResultStatusDetail` values in `o365.audit` to spot anomalous usage patterns.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "o365.audit"
+    and event.action: "UserLoggedIn"
+    and o365.audit.ApplicationId: "aebc6443-996d-45c2-90f0-388ff96faa56"
+    and o365.audit.Target.ID: "00000003-0000-0000-c000-000000000000"
+    and o365.audit.ExtendedProperties.RequestType: "OAuth2:Authorize"
+    and o365.audit.ExtendedProperties.ResultStatusDetail: "Redirect"
+    and o365.audit.UserType: ("0" or "2" or "3" or "5" or "6" or "10")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
new file mode 100644
index 0000000000..f071ff8602
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal]]
+=== Microsoft 365 OAuth Redirect to Device Registration for User Principal
+
+Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365.audit-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 OAuth Redirect to Device Registration for User Principal*
+
+
+
+*Possible investigation steps*
+
+- Review the two UserLoggedIn logs to confirm that they come from different source.ip values and are associated to the same account.
+- Verify all events associated to the source.ip of the the second event in the sequence.
+- Investiguate the details of the new device that was added by reviewing the o365.audit.ModifiedProperties.Device_DisplayName.NewValue attribute.
+- Investigate the user account associated with the successful sign-in to determine if this activity aligns with expected behavior or if it appears suspicious.
+- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
+- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
+
+
+*False positive analysis*
+
+- Both authentcation events of the sequence are originatng from the same source.ip.
+- User using multiple devices and attempted to add a new device post an OAuth code authentication.
+
+
+*Response and remediation*
+
+- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
+- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
+- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
+- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
+- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
+- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
+- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by related.user with maxspan=30m
+[authentication where event.action == "UserLoggedIn" and
+ o365.audit.ExtendedProperties.RequestType == "OAuth2:Authorize" and o365.audit.ExtendedProperties.ResultStatusDetail == "Redirect" and
+ o365.audit.UserType: ("0", "2", "3", "10")] // victim source.ip
+[authentication where event.action == "UserLoggedIn" and
+ o365.audit.ExtendedProperties.RequestType == "OAuth2:Token" and o365.audit.ExtendedProperties.ResultStatusDetail == "Success"] // attacker source.ip to convert oauth code to token
+[web where event.dataset == "o365.audit" and event.action == "Add registered users to device."] // user.name is captured in related.user
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Device Registration
+** ID: T1098.005
+** Reference URL: https://attack.mitre.org/techniques/T1098/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
new file mode 100644
index 0000000000..e013177143
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source]]
+=== Microsoft Azure or Mail Sign-in from a Suspicious Source
+
+This rule correlate Azure or Office 356 mail successful sign-in events with network security alerts by source.ip. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in Logs
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Rule Type: Higher-Order Rule
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Azure or Mail Sign-in from a Suspicious Source*
+
+
+
+*Possible investigation steps*
+
+
+- Investiguate all the alerts associated with the source.ip.
+  - Verify the network security alert details associated with this source.ip.
+  - Verify all sign-in events associated with this source.ip.
+  - Consider the source IP address and geolocation for the involved user account.
+  - Consider the device used to sign in. Is it registered and compliant?
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+==== Setup
+
+
+The Azure Fleet integration, Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-*, .alerts-security.*
+// query runs every 1 hour looking for activities occured during last 8 hours to match on disparate events
+| where @timestamp > NOW() - 8 hours
+// filter for Azure or M365 sign-in and External Alerts with source.ip not null
+| where TO_IP(source.ip) is not null and (event.dataset in ("o365.audit", "azure.signinlogs") or kibana.alert.rule.name == "External Alerts") and
+// exclude private IP ranges
+  not CIDR_MATCH(TO_IP(source.ip), "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1","FE80::/10", "FF00::/8")
+| keep source.ip, event.action, event.outcome, event.dataset, kibana.alert.rule.name, event.category
+// split alerts to 3 buckets -  M365 mail access, azure sign-in and network related external alerts like NGFW and IDS
+| eval mail_access_src_ip = case(event.dataset == "o365.audit" and event.action == "MailItemsAccessed" and event.outcome == "success", TO_IP(source.ip), null),
+  azure_src_ip = case(event.dataset == "azure.signinlogs" and event.outcome == "success", TO_IP(source.ip), null),
+  network_alert_src_ip = case(kibana.alert.rule.name == "External Alerts" and not event.dataset in ("o365.audit", "azure.signinlogs"), TO_IP(source.ip), null)
+// aggregated alerts count by bucket and by source.ip
+| stats total_alerts = count(*), is_mail_access = COUNT_DISTINCT(mail_access_src_ip), is_azure = COUNT_DISTINCT(azure_src_ip), unique_dataset = COUNT_DISTINCT(event.dataset),is_network_alert = COUNT_DISTINCT(network_alert_src_ip), datasets = VALUES(event.dataset), rules = VALUES(kibana.alert.rule.name), cat = VALUES(event.category) by source_ip = TO_IP(source.ip)
+// filter for cases where there is a successful sign-in to azure or m365 mail and the source.ip is reported by a network external alert.
+| where is_network_alert  > 0 and (is_mail_access > 0 or is_azure > 0 and unique_dataset >= 2)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name.asciidoc
new file mode 100644
index 0000000000..ad1b4eca49
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -0,0 +1,146 @@
+[[prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name]]
+=== Microsoft Build Engine Using an Alternate Name
+
+An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Build Engine Using an Alternate Name*
+
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name == "MSBuild.exe" and
+  not process.name : "MSBuild.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
new file mode 100644
index 0000000000..34fcfa1d98
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties]]
+=== Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties
+
+Identifies concurrent azure signin events for the same user and from multiple sources, and where one of the authentication event has some suspicious properties often associated to DeviceCode and OAuth phishing. Adversaries may steal Refresh Tokens (RTs) via phishing to bypass multi-factor authentication (MFA) and gain unauthorized access to Azure resources.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/entra/identity/
+* https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties*
+
+
+
+*Possible investigation steps*
+
+
+- Review the sign-in logs to assess the context and reputation of the source.ip address.
+- Investigate the user account associated with the successful sign-in to determine if the activity aligns with expected behavior or if it appears suspicious.
+- Check for any recent changes or anomalies in the user's account settings or permissions that could indicate compromise.
+- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
+- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
+
+
+*Response and remediation*
+
+
+- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
+- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
+- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
+- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
+- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
+- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
+- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.
+
+==== Setup
+
+
+
+*Required Azure Entra Sign-In Logs*
+
+This rule requires the Azure logs integration be enabled and configured to collect all logs, including sign-in logs from Entra. In Entra, sign-in logs must be enabled and streaming to the Event Hub used for the Azure logs integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-azure.signinlogs* metadata _id, _version, _index
+// the rule is scheduled to run every hour and looks for events occured during last 1 hour.
+| where @timestamp > NOW() - 1 hours
+| where event.dataset == "azure.signinlogs" and source.ip is not null and azure.signinlogs.identity is not null and to_lower(event.outcome) == "success"
+| keep @timestamp, azure.signinlogs.identity, source.ip, azure.signinlogs.properties.authentication_requirement, azure.signinlogs.properties.app_id, azure.signinlogs.properties.resource_display_name, azure.signinlogs.properties.authentication_protocol, azure.signinlogs.properties.app_display_name
+// devicecode authentication no MFA
+| eval device_code = case(azure.signinlogs.properties.authentication_protocol == "deviceCode" and azure.signinlogs.properties.authentication_requirement != "multiFactorAuthentication", azure.signinlogs.identity, null),
+// potential Visual Studio Code OAuth code phish - sign-in events with client set to Visual Studio Code
+ visual_studio = case(azure.signinlogs.properties.app_id == "aebc6443-996d-45c2-90f0-388ff96faa56" and azure.signinlogs.properties.resource_display_name == "Microsoft Graph", azure.signinlogs.identity, null),
+// Other sign-in events
+ other = case(azure.signinlogs.properties.authentication_protocol != "deviceCode" and azure.signinlogs.properties.app_id != "aebc6443-996d-45c2-90f0-388ff96faa56", azure.signinlogs.identity, null)
+| stats total = COUNT(*), device_code_count = COUNT_DISTINCT(device_code), vsc = count_distinct(visual_studio), other_count = COUNT_DISTINCT(other), src_ip = COUNT_DISTINCT(source.ip), ips = values(source.ip), clients = values(azure.signinlogs.properties.app_display_name), resources = VALUES(azure.signinlogs.properties.resource_display_name), auth_requirement = VALUES(azure.signinlogs.properties.authentication_requirement) by azure.signinlogs.identity
+// 2 unique source.ip for same account - which may indicate the presence 2 sign-ins one by the adversary and the other by the victim
+| where src_ip >= 2 and (device_code_count > 0 or vsc >0)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
new file mode 100644
index 0000000000..d697e48e7e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client]]
+=== Microsoft Entra ID OAuth Phishing via Visual Studio Code Client
+
+Detects potentially suspicious OAuth authorization activity in Microsoft Entra ID where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode's Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.signinlogs-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Sign-in Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID OAuth Phishing via Visual Studio Code Client*
+
+
+
+*Possible investigation steps*
+
+
+- Identify the source IP address from which the failed login attempts originated by reviewing `source.ip`. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
+- Analyze affected user accounts by reviewing `azure.signinlogs.properties.user_principal_name` to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
+- Examine the authentication method used in `azure.signinlogs.properties.authentication_details` to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
+- Review the authentication error codes found in `azure.signinlogs.properties.status.error_code` to understand why the login attempts failed. Common errors include `50126` for invalid credentials, `50053` for account lockouts, `50055` for expired passwords, and `50056` for users without a password.
+- Correlate failed logins with other sign-in activity by looking at `event.outcome`. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
+- Review `azure.signinlogs.properties.app_id` to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
+- Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing `azure.signinlogs.properties.authentication_requirement`. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.
+
+
+*False positive analysis*
+
+
+- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
+- Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under `source.ip`.
+- User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in `azure.signinlogs.properties.status.error_code`.
+- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
+- Exlcude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
+- Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering `azure.signinlogs.properties.user_principal_name`.
+- Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.
+
+
+*Response and remediation*
+
+
+- Block the source IP address in `source.ip` if determined to be malicious.
+- Reset passwords for all affected user accounts listed in `azure.signinlogs.properties.user_principal_name` and enforce stronger password policies.
+- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
+- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
+- Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
+- Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
+- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
+- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
+- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
+- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
+- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.signinlogs" and
+event.action: "Sign-in activity" and
+event.outcome: "success" and
+(
+  azure.signinlogs.properties.resource_display_name: "Microsoft Graph" or
+  azure.signinlogs.properties.resource_id: "00000003-0000-0000-c000-000000000000"
+) and (
+  azure.signinlogs.properties.app_id: "aebc6443-996d-45c2-90f0-388ff96faa56" or
+  azure.signinlogs.properties.app_display_name: "Visual Studio Code"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
new file mode 100644
index 0000000000..8268859483
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection]]
+=== Microsoft Entra ID Protection Anonymized IP Risk Detection
+
+Identifies Microsoft Entra ID Protection risk detections triggered due to sign-in activity from anonymized IP addresses, which is often associated with Tor exit nodes, proxies, or anonymizing VPNs. This behavior may indicate evasion tactics or account compromise activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Entra ID
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Protection Anonymized IP Risk Detection*
+
+
+This rule identifies cases where Microsoft Entra ID (formerly Azure AD) detects sign-in activity from anonymized IP addresses,
+often triggered when a user connects via a Tor exit node, privacy VPN, or proxy service.
+
+
+*Possible Investigation Steps:*
+
+
+Review the following fields for context and threat validation:
+
+- `source.ip`: Investigate if the IP is tied to anonymizers (VPNs, proxies, Tor). Check threat intel feeds or proxy/firewall logs to assess reputation. Pivot on this IP to see if it appears in other Azure logs across users.
+- `source.geo.*`: Evaluate the geolocation (city, country, coordinates) of the sign-in. Compare this with known user locations or expected travel patterns.
+- `azure.identityprotection.properties.user_principal_name`: The affected user. Correlate with recent changes in login behavior, app access, or device registration. Review audit logs or recent sign-ins for anomalies.
+- `azure.identityprotection.properties.risk_event_type`: Confirms the type of detection (`anonymizedIPAddress`). Use this to correlate across similar risk types for the same or other users.
+- `azure.identityprotection.properties.additional_info`: This often includes the user agent used in the sign-in (`userAgent`). Investigate automation indicators such as `python-requests`, curl, or scripts.
+- `user_agent.original`: Identify if the user agent string is consistent with the user’s typical environment or tools. Look for anomalies suggesting programmatic access.
+- `azure.identityprotection.properties.risk_level`, `risk_detail`, and `risk_state`: Help gauge severity and whether automated remediation (like MFA enforcement) succeeded.
+- `@timestamp` and `event.ingested`: Validate when the detection occurred versus when it was ingested, which helps determine freshness and accuracy of the event.
+- `azure.signinlogs` for the same user or IP to confirm whether sign-ins occurred with that IP around the same time.
+- `azure.auditlogs` for recent changes to MFA settings, Conditional Access policies, or service principal activity.
+- Identity Protection logs for the same risk type across users to check if this is isolated or part of a larger campaign.
+
+
+*False Positive Analysis*
+
+
+- Anonymized access may occur in environments where privacy tools are permitted (e.g., journalists, remote contractors).
+- Developers or testers using automation from cloud IPs or headless clients may trigger this.
+- Risk state `remediated` might indicate policy-enforced MFA was effective—verify if it aligns with normal activity.
+
+
+*Response and Remediation*
+
+
+- If the sign-in is unauthorized, immediately reset the user’s password and revoke refresh tokens.
+- Notify the user and confirm whether the login was expected.
+- If legitimate, consider excluding specific known anonymized infrastructure from risk detection.
+- Review Conditional Access policies to enforce stricter controls on anonymized IP usage.
+- Monitor for additional risky sign-ins or device registration events tied to the user.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Protection Logs*
+
+To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.identity_protection"
+    and event.action: "User Risk Detection"
+    and azure.identityprotection.properties.risk_event_type: "anonymizedIPAddress"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Proxy
+** ID: T1090
+** Reference URL: https://attack.mitre.org/techniques/T1090/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created.asciidoc
new file mode 100644
index 0000000000..436f3722a2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created]]
+=== Microsoft Entra ID Service Principal Created
+
+Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.auditlogs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
+* https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Service Principal Created*
+
+
+Service Principals are identities used by applications, services, and automation tools to access specific resources. They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make use of service principals. Whenever an application is registered, it automatically creates an application object and a service principal in an Azure AD tenant.
+
+This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate service principals to camouflage their activities among noisy automations/apps.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Consider the source IP address and geolocation for the user who issued the command. Do they look normal for the user?
+- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?
+- Check if this operation was approved and performed according to the organization's change management policy.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Examine the account's commands, API calls, and data management actions in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+
+If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Microsft Entra ID Audit Logs*
+
+This rule requires the Azure integration with Microsoft Entra ID Audit Logs data stream ingesting in your Elastic Stack deployment. For more information, refer to the https://www.elastic.co/docs/reference/integrations/azure/adlogs[Microsoft Entra ID Audit Logs integration documentation].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:azure.auditlogs
+    and azure.auditlogs.operation_name:"Add service principal"
+    and event.outcome:(success or Success)
+    and not azure.auditlogs.identity: (
+        "Managed Service Identity" or
+        "Windows Azure Service Management API" or
+        "Microsoft Azure AD Internal - Jit Provisioning" or
+        "AAD App Management" or
+        "Power Virtual Agents Service"
+        )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
new file mode 100644
index 0000000000..87d399fd27
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker]]
+=== Microsoft Entra ID SharePoint Access for User Principal via Auth Broker
+
+This rule detects non-interactive authentication activity against SharePoint Online (`Office 365 SharePoint Online`) by a user principal via the `Microsoft Authentication Broker` application. The session leverages a refresh token or Primary Refresh Token (PRT) without interactive sign-in, often used in OAuth phishing or token replay scenarios.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-azure.signinlogs-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Use Case: Identity and Access Audit
+* Tactic: Collection
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Sign-in Logs
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID SharePoint Access for User Principal via Auth Broker*
+
+
+This rule identifies non-interactive sign-ins to SharePoint Online via the Microsoft Authentication Broker application using a refresh token or Primary Refresh Token (PRT). This type of activity may indicate token replay attacks, OAuth abuse, or automated access from previously consented apps or stolen sessions.
+
+This is a https://www.elastic.co/guide/en/security/current/new-terms-rules.html[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
+
+
+*Possible Investigation Steps:*
+
+
+- `azure.signinlogs.properties.user_principal_name`: Identify the user involved. Investigate whether this user typically accesses SharePoint or if this is an anomaly.
+- `azure.signinlogs.properties.app_display_name`: Verify the application used (e.g., Authentication Broker). Determine if the app is expected for SharePoint access in your environment.
+- `azure.signinlogs.properties.resource_display_name`: Review the resource being accessed. SharePoint activity should be aligned with job roles or historical usage.
+- `azure.signinlogs.properties.incoming_token_type`: Indicates the token type used. Look for `refreshToken` or `primaryRefreshToken`, which may point to token replay or silent access.
+- `azure.signinlogs.properties.is_interactive`: If false, indicates the sign-in was non-interactive. Correlate with recent sign-ins to understand if a prior session may have been reused.
+- `user_agent.original`: Analyze the user agent string for automation indicators (e.g., scripts, unusual clients). Compare with what’s typical for the user or device.
+- `source.ip`: Check the originating IP address. Investigate if the IP is associated with data centers, VPNs, anonymizers, or is geographically unusual for the user.
+- `source.geo.*`: Evaluate sign-in location details. Determine if the sign-in location aligns with expected travel or usage behavior.
+- `azure.signinlogs.properties.applied_conditional_access_policies`: Review whether Conditional Access policies were triggered or bypassed. Investigate if required controls (like MFA) were applied.
+- `azure.signinlogs.properties.authentication_processing_details`: Review any details about the authentication, such as token type or scopes. This may indicate delegated access or automation patterns.
+
+
+*False Positive Analysis*
+
+
+- Certain MDM or mobile app scenarios may use refresh tokens legitimately via brokered apps.
+- Automated processes using authorized, scripted clients could trigger this activity, especially in developer or operations environments.
+- If Conditional Access policies are configured in “report-only” mode or exempted for trusted apps, activity may appear unusual but be authorized.
+
+
+*Response and Remediation*
+
+
+- If activity appears unauthorized:
+  - Investigate and revoke active sessions or refresh tokens.
+  - Notify the user and validate expected activity.
+  - Review and audit app consent permissions and remove unused or high-risk delegated access.
+- Harden Conditional Access policies to limit non-interactive access to sensitive resources.
+- Monitor for repeated use of the same user agent, IP, or token type across other users to identify broader campaigns.
+- Consider alerting on unusual patterns in sign-in frequency, geography, and application usage for SharePoint and other key services.
+
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Sign-In Logs*
+
+To use this rule, ensure that Microsoft Entra ID Sign-In Logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.signinlogs"
+    and azure.signinlogs.properties.app_id: "29d9ed98-a469-4536-ade2-f981bc1d605e"
+    and azure.signinlogs.properties.resource_id: "00000003-0000-0ff1-ce00-000000000000"
+    and azure.signinlogs.identity: *
+    and azure.signinlogs.properties.user_principal_name: *
+    and azure.signinlogs.properties.incoming_token_type: ("refreshToken" or "primaryRefreshToken")
+    and azure.signinlogs.properties.is_interactive: false
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Information Repositories
+** ID: T1213
+** Reference URL: https://attack.mitre.org/techniques/T1213/
+* Sub-technique:
+** Name: Sharepoint
+** ID: T1213.002
+** Reference URL: https://attack.mitre.org/techniques/T1213/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request.asciidoc
new file mode 100644
index 0000000000..2010540041
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request]]
+=== Microsoft Graph First Occurrence of Client Request
+
+This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.graphactivitylogs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Graph
+* Data Source: Microsoft Graph Activity Logs
+* Resources: Investigation Guide
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Graph First Occurrence of Client Request*
+
+
+This rule detects the first observed occurrence of a Microsoft Graph API request by a specific client application ID (`azure.graphactivitylogs.properties.app_id`) in combination with a user principal object ID (`azure.graphactivitylogs.properties.user_principal_object_id`) and tenant ID (`azure.tenant_id`) within the last 14 days. This may indicate unauthorized access following a successful phishing attempt, token theft, or abuse of OAuth workflows.
+
+Adversaries frequently exploit legitimate Microsoft or third-party application IDs to avoid raising suspicion during initial access. By using pre-consented or trusted apps to interact with Microsoft Graph, attackers can perform actions on behalf of users without triggering conventional authentication alerts or requiring additional user interaction.
+
+
+*Possible investigation steps*
+
+
+- Review `azure.graphactivitylogs.properties.user_principal_object_id` and correlate with recent sign-in logs for the associated user.
+- Determine whether `azure.graphactivitylogs.properties.app_id` is a known and approved application in your environment.
+- Investigate the `user_agent.original` field for signs of scripted access (e.g., automation tools or libraries).
+- Check the source IP address (`source.ip`) and geolocation data (`source.geo.*`) for unfamiliar origins.
+- Inspect `azure.graphactivitylogs.properties.scopes` to understand the level of access being requested by the app.
+- Examine any follow-up Graph API activity from the same `app_id` or `user_principal_object_id` for signs of data access or exfiltration.
+- Correlate with device or session ID fields (`azure.graphactivitylogs.properties.c_sid`, if present) to detect persistent or repeat activity.
+
+
+*False positive analysis*
+
+
+- First-time use of a legitimate Microsoft or enterprise-approved application.
+- Developer or automation workflows initiating new Graph API requests.
+- Valid end-user activity following device reconfiguration or new client installation.
+- Maintain an allowlist of expected `app_id` values and known developer tools.
+- Suppress detections from known good `user_agent.original` strings or approved source IP ranges.
+- Use device and identity telemetry to distinguish trusted vs. unknown activity sources.
+- Combine with session risk or sign-in anomaly signals where available.
+
+
+*Response and remediation*
+
+
+- Reach out to the user and verify whether they authorized the application access.
+- Revoke active OAuth tokens and reset credentials if unauthorized use is confirmed.
+- Search for additional Graph API calls made by the same `app_id` or `user_principal_object_id`.
+- Investigate whether sensitive resources (mail, files, Teams, contacts) were accessed.
+- Apply Conditional Access policies to limit Graph API access by app type, IP, or device state.
+- Restrict user consent for third-party apps and enforce admin approval workflows.
+- Monitor usage of new or uncommon `app_id` values across your tenant.
+- Provide user education on OAuth phishing tactics and reporting suspicious prompts.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.graphactivitylogs"
+    and event.type: "access"
+    and azure.graphactivitylogs.properties.c_idtyp: "user"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
new file mode 100644
index 0000000000..4bf1af5807
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
@@ -0,0 +1,120 @@
+[[prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal]]
+=== Multiple Microsoft Entra ID Protection Alerts by User Principal
+
+Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Protection Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Multiple Microsoft Entra ID Protection Alerts by User Principal*
+
+
+
+*Possible investigation steps*
+
+- Identify the Risk Detection that triggered the event. A list with descriptions can be found https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection[here].
+- Identify the user account involved and validate whether the suspicious activity is normal for that user.
+  - Consider the source IP address and geolocation for the involved user account. Do they look normal?
+  - Consider the device used to sign in. Is it registered and compliant?
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
+- Consider the context of the user account and whether the activity is expected. For example, if the user is a developer or administrator, they may have legitimate reasons for accessing resources from various locations or devices.
+
+
+*Response and remediation*
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
+[any where event.module == "azure" and event.dataset == "azure.identity_protection"] with runs=2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec.asciidoc
new file mode 100644
index 0000000000..646bd597e0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec.asciidoc
@@ -0,0 +1,80 @@
+[[prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec]]
+=== Potential Backdoor Execution Through PAM_EXEC
+
+This rule detects SSH session ID change followed by a suspicious SSHD child process, this may indicate the successful execution of a potentially malicious process through the Pluggable Authentication Module (PAM) utility. PAM is a framework used by Linux systems to authenticate users. Adversaries may create malicious PAM modules that grant them persistence onto the target every time a user logs in by executing a backdoor script or command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/approaching-the-summit-on-persistence
+* https://www.group-ib.com/blog/pluggable-authentication-module/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=3s
+  [process where host.os.type == "linux" and event.type == "change" and event.action == "session_id_change" and process.name in ("ssh", "sshd")]
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name in ("ssh", "sshd") and
+   process.args_count == 2 and (
+     process.name like ("perl*", "python*", "php*", "ruby*", "lua*") or
+     process.executable like (
+       "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/boot/*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
+       "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*") or
+     process.name like ".*"
+   )]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl.asciidoc
new file mode 100644
index 0000000000..4cead2d37e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl.asciidoc
@@ -0,0 +1,114 @@
+[[prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl]]
+=== Potential Data Exfiltration Through Curl
+
+Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://everything.curl.dev/usingcurl/uploads
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "curl" and
+process.parent.executable != null and (process.args in ("-F", "-T", "-d") or process.args like "--data*") and 
+process.command_line like~ ("*@/*.zip*", "*@/*.gz*", "*@/*.tgz*", "*b64=@*", "*=<*") and
+process.command_line like~ "*http*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Alternative Protocol
+** ID: T1048
+** Reference URL: https://attack.mitre.org/techniques/T1048/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
new file mode 100644
index 0000000000..dcb70883de
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables]]
+=== Potential Dynamic IEX Reconstruction via Environment Variables
+
+Identifies PowerShell scripts that reconstruct the IEX (Invoke-Expression) command at runtime using indexed slices of environment variables. This technique leverages character access and join operations to build execution logic dynamically, bypassing static keyword detection and evading defenses such as AMSI.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(?i)(\$(?:\w+|\w+\:\w+)\[\d++\]\+\$(?:\w+|\w+\:\w+)\[\d++\]\+['"]x['"]|\$(?:\w+\:\w+)\[\d++,\d++,\d++\]|\.name\[\d++,\d++,\d++\])""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line.asciidoc
new file mode 100644
index 0000000000..61ed7dae08
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line]]
+=== Potential Hex Payload Execution via Command-Line
+
+This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use hexadecimal encoding to obfuscate their payload and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.parent.executable != null and
+process.command_line : "*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*" and
+length(process.command_line) > 50
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility.asciidoc
new file mode 100644
index 0000000000..e7a510faa9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility.asciidoc
@@ -0,0 +1,186 @@
+[[prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility]]
+=== Potential Hex Payload Execution via Common Utility
+
+This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+* logs-crowdstrike.fdr*
+* logs-sentinel_one_cloud_funnel.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Potential Hex Payload Execution via Common Utility*
+
+
+Hex encoding is often used in Linux environments to obfuscate data, making it harder for security tools to detect malicious payloads. Adversaries exploit this by encoding their payloads in hex to bypass security measures. The detection rule identifies suspicious processes like `xxd`, `python`, `php`, and others that use hex-related functions, signaling potential obfuscation attempts. By monitoring these patterns, the rule helps uncover hidden threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details, including the process name and command line arguments, to confirm if the execution aligns with typical hex decoding or encoding activities.
+- Check the parent process of the suspicious process to understand the context of how the process was initiated and whether it was expected or part of a legitimate workflow.
+- Investigate the user account associated with the process execution to determine if the activity is consistent with the user's normal behavior or if the account may have been compromised.
+- Examine the network activity associated with the process to identify any potential data exfiltration or communication with known malicious IP addresses.
+- Look for any related file modifications or creations around the time of the process execution to identify if the decoded payload was written to disk or executed further.
+- Cross-reference the alert with other security tools or logs, such as Crowdstrike or SentinelOne, to gather additional context or corroborating evidence of malicious activity.
+
+
+*False positive analysis*
+
+
+- Development and testing environments may frequently use hex encoding functions for legitimate purposes. To reduce noise, consider excluding processes running on known development servers from the rule.
+- System administrators might use hex encoding tools like `xxd` for data conversion tasks. Identify and whitelist these routine administrative scripts to prevent false alerts.
+- Automated scripts or applications that process data in hex format for encoding or decoding purposes can trigger this rule. Review and exclude these scripts if they are verified as non-malicious.
+- Security tools or monitoring solutions themselves might use hex encoding for data analysis. Ensure these tools are recognized and excluded from triggering the rule.
+- Regularly review and update the exclusion list to adapt to changes in the environment and ensure that only verified non-threatening behaviors are excluded.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of potentially malicious payloads.
+- Terminate any suspicious processes identified by the detection rule, such as those involving `xxd`, `python`, `php`, `ruby`, `perl`, or `lua` with hex-related functions.
+- Conduct a thorough scan of the isolated system using updated antivirus and anti-malware tools to identify and remove any malicious payloads or remnants.
+- Review and analyze system logs and process execution history to determine the scope of the compromise and identify any additional affected systems.
+- Restore the system from a known good backup if malicious activity is confirmed and cannot be fully remediated.
+- Implement additional monitoring on the affected system and network to detect any recurrence of similar obfuscation attempts.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the need for broader organizational response measures.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+  event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+  (
+    (process.name == "xxd" and process.args like ("-r*", "-p*")) or
+    (process.name like "python*" and process.command_line like "*fromhex*" and process.command_line like ("*decode*", "*encode*")) or
+    (process.name like "php*" and process.command_line like "*hex2bin*") or
+    (process.name like "ruby*" and process.command_line like "*].pack(\"H*\")*") or
+    (process.name like "perl*" and process.command_line like "*pack(\"H*\",*") or
+    (process.name like "lua*" and process.command_line like "*tonumber(cc, 16)*")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
new file mode 100644
index 0000000000..ef0cf32361
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
@@ -0,0 +1,110 @@
+[[prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option]]
+=== Potential Linux Tunneling and/or Port Forwarding via SSH Option
+
+This rule detects the use of SSH options that may indicate tunneling or port forwarding on Linux systems. This behavior is commonly associated with malicious activity, such as establishing a port forward, proxy or an encrypted tunnel to exfiltrate data.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
+* https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("ssh", "sshd") and process.args == "-o" and
+process.command_line like~ (
+  "*ProxyCommand*", "*LocalForward*", "*RemoteForward*", "*DynamicForward*", "*Tunnel*", "*GatewayPorts*",
+  "*ExitOnForwardFailure*", "*ProxyCommand*", "*ProxyJump*"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer.asciidoc
new file mode 100644
index 0000000000..7f6a25346c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer.asciidoc
@@ -0,0 +1,268 @@
+[[prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer]]
+=== Potential Masquerading as Business App Installer
+
+Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers
+
+*Tags*: 
+
+* Domain: Endpoint
+* Data Source: Elastic Defend
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Initial Access
+* Tactic: Execution
+* Resources: Investigation Guide
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Masquerading as Business App Installer*
+
+
+Business applications are integral to productivity, often downloaded and installed by users. Adversaries exploit this by creating malicious executables with names mimicking legitimate apps, tricking users into installing them. The detection rule identifies such threats by checking for unsigned executables in download directories, ensuring they don't masquerade as trusted applications.
+
+
+*Possible investigation steps*
+
+
+- Review the process name and executable path to confirm if it matches any known legitimate business application names listed in the rule, such as Slack, WebEx, or Teams, and verify if it was executed from a typical download directory.
+- Check the process code signature status and subject name to determine if the executable is unsigned or signed by an untrusted entity, which could indicate a masquerading attempt.
+- Investigate the source of the download by examining browser history, email attachments, or any recent file transfers to identify potential phishing attempts or malicious download sources.
+- Analyze the process execution context, including parent processes and command-line arguments, to understand how the executable was launched and if it aligns with typical user behavior.
+- Look for any network connections initiated by the process to identify suspicious outbound traffic or connections to known malicious IP addresses or domains.
+- Cross-reference the executable's hash with threat intelligence databases to check for known malware signatures or previous reports of malicious activity.
+- If the executable is determined to be suspicious, isolate the affected system and perform a full malware scan to prevent further compromise.
+
+
+*False positive analysis*
+
+
+- Unsigned executables from legitimate developers may trigger alerts if they are not properly signed or if the signature is not recognized. Users can create exceptions for specific executables by verifying the developer's authenticity and adding them to a trusted list.
+- Custom or in-house developed applications that mimic business app names but are unsigned can cause false positives. Organizations should ensure these applications are signed with a trusted certificate or add them to an exclusion list after verifying their safety.
+- Software updates or beta versions of legitimate applications might not have updated signatures, leading to false positives. Users should verify the source of the update and, if legitimate, temporarily exclude these versions from the rule.
+- Applications installed in non-standard directories that match the naming patterns but are legitimate can be excluded by specifying trusted paths or directories in the rule configuration.
+- Third-party tools or utilities that integrate with business applications and use similar naming conventions might be flagged. Users should verify these tools and, if safe, add them to an exception list to prevent future alerts.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
+- Terminate the suspicious process identified by the alert to stop any ongoing malicious actions.
+- Quarantine the executable file flagged by the detection rule to prevent execution and further analysis.
+- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or remnants.
+- Review and analyze the process execution logs and any related network activity to understand the scope of the intrusion and identify any other potentially compromised systems.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement application whitelisting to prevent unauthorized executables from running, ensuring only trusted and signed applications are allowed to execute.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
+  not process.code_signature.status : ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and
+  (
+    /* Slack */
+    (process.name : "*slack*.exe" and not
+      (process.code_signature.subject_name in (
+        "Slack Technologies, Inc.",
+        "Slack Technologies, LLC"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "*webex*.exe" and not
+      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "teams*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "*discord*.exe" and not
+      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "*whatsapp*.exe" and not
+      (process.code_signature.subject_name in (
+        "WhatsApp LLC",
+        "WhatsApp, Inc",
+        "24803D75-212C-471A-BC57-9EF86AB91435"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe")  and not
+      (process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Outlook */
+    (process.name : "*outlook*.exe" and not
+      (
+        (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) or
+        (
+          process.name: "MSOutlookHelp-PST-Viewer.exe" and process.code_signature.subject_name == "Aryson Technologies Pvt. Ltd" and
+          process.code_signature.trusted == true
+        )
+      )
+    ) or
+
+    /* Thunderbird */
+    (process.name : "*thunderbird*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Grammarly */
+    (process.name : "*grammarly*.exe" and not
+      (process.code_signature.subject_name == "Grammarly, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Dropbox */
+    (process.name : "*dropbox*.exe" and not
+      (process.code_signature.subject_name == "Dropbox, Inc" and process.code_signature.trusted == true)
+    ) or
+
+    /* Tableau */
+    (process.name : "*tableau*.exe" and not
+      (process.code_signature.subject_name == "Tableau Software LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Google Drive */
+    (process.name : "*googledrive*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* MSOffice */
+    (process.name : "*office*setup*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Okta */
+    (process.name : "*okta*.exe" and not
+      (process.code_signature.subject_name == "Okta, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* OneDrive */
+    (process.name : "*onedrive*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Chrome */
+    (process.name : "*chrome*.exe" and not
+      (process.code_signature.subject_name in ("Google LLC", "Google Inc") and process.code_signature.trusted == true)
+    ) or
+
+    /* Firefox */
+    (process.name : "*firefox*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Edge */
+    (process.name : ("*microsoftedge*.exe", "*msedge*.exe") and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Brave */
+    (process.name : "*brave*.exe" and not
+      (process.code_signature.subject_name == "Brave Software, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* GoogleCloud Related Tools */
+    (process.name : "*GoogleCloud*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Github Related Tools */
+    (process.name : "*github*.exe" and not
+      (process.code_signature.subject_name == "GitHub, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Notion */
+    (process.name : "*notion*.exe" and not
+      (process.code_signature.subject_name == "Notion Labs, Inc." and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Drive-by Compromise
+** ID: T1189
+** Reference URL: https://attack.mitre.org/techniques/T1189/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps.asciidoc
new file mode 100644
index 0000000000..5e4608b3d3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps.asciidoc
@@ -0,0 +1,184 @@
+[[prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps]]
+=== Potential Masquerading as Communication Apps
+
+Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 10
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Masquerading as Communication Apps*
+
+
+Communication apps are integral to modern workflows, facilitating seamless interaction. However, adversaries can exploit these apps by masquerading malicious processes as legitimate ones, bypassing security measures and deceiving users. The detection rule identifies suspicious instances by checking for unsigned or improperly signed processes, ensuring they match known trusted signatures. This helps in flagging potential threats that mimic trusted communication tools, aiding in defense evasion detection.
+
+
+*Possible investigation steps*
+
+
+- Review the process name and code signature details to confirm if the process is indeed masquerading as a legitimate communication app. Check if the process name matches any of the specified apps like slack.exe, WebexHost.exe, etc., and verify the code signature subject name and trust status.
+- Investigate the origin of the executable file by checking its file path and creation date. Determine if it was recently added or modified, which might indicate suspicious activity.
+- Analyze the parent process to understand how the suspicious process was initiated. This can provide insights into whether it was launched by a legitimate application or a potentially malicious script or program.
+- Check for any network connections initiated by the suspicious process. Look for unusual or unauthorized external connections that might suggest data exfiltration or command and control communication.
+- Review recent system logs and security alerts for any related activities or anomalies that coincide with the start of the suspicious process. This can help identify if the process is part of a larger attack pattern.
+- Consult threat intelligence sources to see if there are any known indicators of compromise (IOCs) associated with the process or its hash value, which can help in assessing the threat level.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may temporarily result in unsigned or improperly signed processes. Users can create exceptions for known update processes to prevent false positives during these periods.
+- Custom or internally developed communication tools that mimic the names of popular apps might trigger alerts. Ensure these tools are properly signed and add them to an allowlist if they are trusted.
+- Some third-party security or monitoring tools may interact with communication apps in a way that alters their signature status. Verify the legitimacy of these tools and consider excluding them from the rule if they are deemed safe.
+- In environments where communication apps are deployed via non-standard methods, such as portable versions, ensure these versions are signed correctly or add them to an exception list if they are verified as safe.
+- Temporary network issues or system misconfigurations might cause legitimate apps to appear unsigned. Regularly audit and correct any network or system issues to minimize these occurrences.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further spread of potential malware or unauthorized access.
+- Terminate any suspicious processes identified by the detection rule that are masquerading as communication apps, ensuring they are not legitimate processes.
+- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any malicious files or software.
+- Review and validate the code signatures of all communication apps on the affected system to ensure they are properly signed by trusted entities.
+- Restore any compromised systems from a known good backup to ensure the integrity of the system and data.
+- Monitor network traffic and system logs for any signs of lateral movement or further attempts to exploit communication apps.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and
+  (
+    /* Slack */
+    (process.name : "slack.exe" and not
+      (process.code_signature.subject_name in (
+        "Slack Technologies, Inc.",
+        "Slack Technologies, LLC"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "WebexHost.exe" and not
+      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "Teams.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "Discord.exe" and not
+      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* RocketChat */
+    (process.name : "Rocket.Chat.exe" and not
+      (process.code_signature.subject_name == "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true)
+    ) or
+
+    /* Mattermost */
+    (process.name : "Mattermost.exe" and not
+      (process.code_signature.subject_name == "Mattermost, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "WhatsApp.exe" and not
+      (process.code_signature.subject_name in (
+        "WhatsApp LLC",
+        "WhatsApp, Inc",
+        "24803D75-212C-471A-BC57-9EF86AB91435"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : "Zoom.exe" and not
+      (process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Outlook */
+    (process.name : "outlook.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Thunderbird */
+    (process.name : "thunderbird.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Compromise Host Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
new file mode 100644
index 0000000000..c2969ca115
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion]]
+=== Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
+
+Identifies PowerShell scripts that use backtick-escaped characters inside ${} variable expansion as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """\$\{(\w++`){2,}\w++\}""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, file.name, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
new file mode 100644
index 0000000000..d2c1ff4113
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction]]
+=== Potential PowerShell Obfuscation via Character Array Reconstruction
+
+Identifies PowerShell scripts that use character arrays and runtime string reconstruction as a form of obfuscation. This technique breaks strings into individual characters, often using constructs like char[] with index-based access or joining logic. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Filter for scripts that contain the "char" keyword using MATCH, boosts the query performance
+| WHERE powershell.file.script_block_text : "char"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(char\[\]\]\(\d+,\d+[^)]+|(\s?\(\[char\]\d+\s?\)\+){2,})""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
new file mode 100644
index 0000000000..aa91cdef1e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
@@ -0,0 +1,109 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation]]
+=== Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
+
+Identifies PowerShell scripts that use concatenated strings within dynamic command invocation (&() or .()) as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104" and powershell.file.script_block_text LIKE "*+*"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[.&]\(\s*(['"][A-Za-z0-9.-]+['"]\s*\+\s*)+['"][A-Za-z0-9.-]+['"]\s*\)""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
new file mode 100644
index 0000000000..8c73316aad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion]]
+=== Potential PowerShell Obfuscation via High Numeric Character Proportion
+
+Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code manipulation, or embedded encoded strings used to deliver and execute malicious content.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[0-9]""", "🔥")
+
+// Count the occurrence of numbers and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 25%+ proportion of numbers
+| WHERE proportion > 0.25
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
new file mode 100644
index 0000000000..087bfa606f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences]]
+=== Potential PowerShell Obfuscation via Invalid Escape Sequences
+
+Identifies PowerShell scripts that use invalid escape sequences as a form of obfuscation. This technique introduces backticks (`) between characters in a way that does not correspond to valid PowerShell escape sequences, breaking up strings and bypassing pattern-based detections while preserving execution logic. This is designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104" and powershell.file.script_block_text LIKE "*`*"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[A-Za-z0-9_-]`(?![rntb]|\r|\n|\d)[A-Za-z0-9_-]""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.name, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 10
+
+// Filter FPs, and due to the behavior of the LIKE operator, allow null values
+| WHERE (file.name NOT LIKE "TSS_*.psm1" or file.name IS NULL)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords.asciidoc
new file mode 100644
index 0000000000..33529201c3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords]]
+=== Potential PowerShell Obfuscation via Reverse Keywords
+
+Identifies PowerShell scripts that use reversed strings as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Filter for scripts that contains these keywords using MATCH, boosts the query performance, match will ignore the | and look for the individual words
+| WHERE powershell.file.script_block_text : "rahc|metsys|stekcos|tcejboimw|ecalper|ecnerferpe|noitcennoc|nioj|eman|vne|gnirts|tcejbo-wen|_23niw|noisserpxe|ekovni|daolnwod"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(?i)(rahc|metsys|stekcos|tcejboimw|ecalper|ecnerferpe|noitcennoc|nioj|eman\.|:vne|gnirts|tcejbo-wen|_23niw|noisserpxe|ekovni|daolnwod)""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, agent.id
+| WHERE count >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse.asciidoc
new file mode 100644
index 0000000000..cf9abd9629
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse]]
+=== Potential PowerShell Obfuscation via Special Character Overuse
+
+Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative of obfuscation. This behavior is commonly associated with techniques such as SecureString encoding, formatting obfuscation, or character-level manipulation designed to bypass static analysis and AMSI inspection.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[\s\$\{\}\+\@\=\(\)\^\\\"~\[\]\?\.]""", "🔥")
+
+// Count the occurrence of numbers and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 75%+ proportion of numbers
+| WHERE proportion > 0.75
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation.asciidoc
new file mode 100644
index 0000000000..be3e51b9c0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation]]
+=== Potential PowerShell Obfuscation via String Concatenation
+
+Identifies PowerShell scripts that use string concatenation as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """['"][A-Za-z0-9.]+['"](\s?\+\s?['"][A-Za-z0-9.,\-\s]+['"]){2,}""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl.asciidoc
new file mode 100644
index 0000000000..632835386e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl.asciidoc
@@ -0,0 +1,158 @@
+[[prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl]]
+=== Potential Process Name Stomping with Prctl
+
+This rule leverages Auditd data to detect the use of the `prctl` syscall to potentially hide a process by changing its name. The `prctl` syscall is used to control various process attributes. Attackers can use this syscall to change the name of a process to a hidden directory or file, making it harder to detect. The query looks for the `prctl` syscall with the `PR_SET_NAME` argument set to `f` (PR_SET_NAME is used to set the name of a process).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-auditd_manager.auditd-*
+* auditbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://haxrob.net/process-name-stomping/
+* https://haxrob.net/hiding-in-plain-sight-part-2/
+* https://www.elastic.co/security-labs/linux-detection-engineering-with-auditd
+
+*Tags*: 
+
+* Data Source: Auditd Manager
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Process Name Stomping with Prctl*
+
+
+The `prctl` syscall in Linux allows processes to modify their attributes, including renaming themselves. This capability can be exploited by attackers to disguise malicious processes, making them harder to identify. The detection rule monitors for `prctl` invocations with specific arguments indicative of name changes, especially when linked to suspicious directories, thus flagging potential evasion attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the process details associated with the alert, focusing on the executable path to determine if it matches any suspicious directories listed in the query, such as "/tmp/*" or "/var/tmp/*".
+- Examine the process tree to identify the parent process and any child processes spawned by the suspicious process, which may provide context on how the process was initiated and its potential impact.
+- Check the command line arguments and environment variables of the process to gather additional context on its intended function and any anomalies.
+- Investigate the user account under which the process is running to determine if it aligns with expected behavior or if it indicates potential compromise.
+- Correlate the alert with other security events or logs, such as file modifications or network connections, to identify any related malicious activity or patterns.
+- Assess the historical activity of the process executable and its associated files to determine if this behavior is new or part of a recurring pattern.
+
+
+*False positive analysis*
+
+
+- System maintenance scripts may invoke prctl to rename processes for legitimate reasons. Review scheduled tasks and maintenance scripts in directories like /etc/cron.* and /etc/init.d to identify benign uses.
+- Development environments often use prctl for testing purposes. Exclude known development directories such as /home/developer or /tmp/dev from the rule to reduce noise.
+- Some monitoring or logging tools might use prctl to rename their processes for clarity. Identify these tools and add their executable paths to an exception list.
+- Custom scripts or applications that manage process names for operational reasons should be documented. Exclude these scripts by specifying their paths in the rule configuration.
+- Regularly review and update the exception list to ensure it reflects the current environment and does not inadvertently exclude new threats.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further malicious activity or lateral movement.
+- Terminate any suspicious processes identified by the detection rule, especially those with altered names in critical directories.
+- Conduct a thorough review of the affected system's process tree and file system to identify any additional signs of compromise or persistence mechanisms.
+- Restore any altered or suspicious files from a known good backup to ensure system integrity.
+- Update and patch the affected system to close any vulnerabilities that may have been exploited by the attacker.
+- Monitor the network for any signs of similar activity or attempts to use the `prctl` syscall with the `PR_SET_NAME` argument in other systems.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if broader organizational impacts exist.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Auditd Manager.
+
+
+*Auditd Manager Integration Setup*
+
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+
+*The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:*
+
+- Go to the Kibana home page and click “Add integrations”.
+- In the query bar, search for “Auditd Manager” and select the integration to see more details about it.
+- Click “Add Auditd Manager”.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed “auditd manager” to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click “Save and Continue”.
+- For more details on the integration refer to the https://docs.elastic.co/integrations/auditd_manager[helper guide].
+
+
+*Rule Specific Setup Note*
+
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-a exit,always -F arch=b64 -S prctl -k prctl_detection"
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and auditd.data.syscall == "prctl" and auditd.data.a0 == "f" and
+process.executable like (
+  "/boot/*", "/dev/shm/*", "/etc/cron.*/*", "/etc/init.d/*", "/var/run/*", "/etc/update-motd.d/*",
+  "/tmp/*", "/var/log/*", "/var/tmp/*", "/home/*", "/run/shm/*", "/run/*", "./*"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading.asciidoc
new file mode 100644
index 0000000000..d506ac1993
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading]]
+=== Potential Windows Error Manager Masquerading
+
+Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-endpoint.events.network-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/SBousseaden/status/1235533224337641473
+* https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/
+* https://app.any.run/tasks/26051d84-b68e-4afb-8a9a-76921a271b81/
+* https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 213
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Windows Error Manager Masquerading*
+
+
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
+
+This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan = 5s
+  [process where host.os.type == "windows" and event.type:"start" and process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1]
+  [network where host.os.type == "windows" and process.name : ("wermgr.exe", "WerFault.exe") and network.protocol != "dns" and
+    network.direction : ("outgoing", "egress") and destination.ip !="::1" and destination.ip !="127.0.0.1"
+  ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal.asciidoc
new file mode 100644
index 0000000000..18897c7f0f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal]]
+=== PowerShell Obfuscation via Negative Index String Reversal
+
+Identifies PowerShell scripts that use negative index ranges to reverse the contents of a string or array at runtime as a form of obfuscation. This technique avoids direct use of reversal functions by iterating through array elements in reverse order. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """\$\w+\[\-\s?1\.\.""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+// FP Patterns
+| WHERE NOT powershell.file.script_block_text LIKE "*GENESIS-5654*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory.asciidoc
new file mode 100644
index 0000000000..0dd6a99290
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory.asciidoc
@@ -0,0 +1,191 @@
+[[prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory]]
+=== Process Execution from an Unusual Directory
+
+Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 318
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Process Execution from an Unusual Directory*
+
+
+This rule identifies processes that are executed from suspicious default Windows directories. Adversaries may abuse this technique by planting malware in trusted paths, making it difficult for security analysts to discern if their activities are malicious or take advantage of exceptions that may apply to these paths.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes, examining their executable files for prevalence, location, and valid digital signatures.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Examine arguments and working directory to determine the program's source or the nature of the tasks it is performing.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of executable and signature conditions.
+
+
+*Related Rules*
+
+
+- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
+- Execution from Unusual Directory - Command Line - cff92c41-2225-4763-b4ce-6f71e5bda5e6
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  /* add suspicious execution paths here */
+  process.executable : (
+    "?:\\PerfLogs\\*.exe", "?:\\Users\\Public\\*.exe", "?:\\Windows\\Tasks\\*.exe",
+    "?:\\Intel\\*.exe", "?:\\AMD\\Temp\\*.exe", "?:\\Windows\\AppReadiness\\*.exe",
+    "?:\\Windows\\ServiceState\\*.exe", "?:\\Windows\\security\\*.exe", "?:\\Windows\\IdentityCRL\\*.exe",
+    "?:\\Windows\\Branding\\*.exe", "?:\\Windows\\csc\\*.exe", "?:\\Windows\\DigitalLocker\\*.exe",
+    "?:\\Windows\\en-US\\*.exe", "?:\\Windows\\wlansvc\\*.exe", "?:\\Windows\\Prefetch\\*.exe",
+    "?:\\Windows\\Fonts\\*.exe", "?:\\Windows\\diagnostics\\*.exe", "?:\\Windows\\TAPI\\*.exe",
+    "?:\\Windows\\INF\\*.exe", "?:\\Windows\\System32\\Speech\\*.exe", "?:\\windows\\tracing\\*.exe",
+    "?:\\windows\\IME\\*.exe", "?:\\Windows\\Performance\\*.exe", "?:\\windows\\intel\\*.exe",
+    "?:\\windows\\ms\\*.exe", "?:\\Windows\\dot3svc\\*.exe", "?:\\Windows\\panther\\*.exe",
+    "?:\\Windows\\RemotePackages\\*.exe", "?:\\Windows\\OCR\\*.exe", "?:\\Windows\\appcompat\\*.exe",
+    "?:\\Windows\\apppatch\\*.exe", "?:\\Windows\\addins\\*.exe", "?:\\Windows\\Setup\\*.exe",
+    "?:\\Windows\\Help\\*.exe", "?:\\Windows\\SKB\\*.exe", "?:\\Windows\\Vss\\*.exe",
+    "?:\\Windows\\Web\\*.exe", "?:\\Windows\\servicing\\*.exe", "?:\\Windows\\CbsTemp\\*.exe",
+    "?:\\Windows\\Logs\\*.exe", "?:\\Windows\\WaaS\\*.exe", "?:\\Windows\\ShellExperiences\\*.exe",
+    "?:\\Windows\\ShellComponents\\*.exe", "?:\\Windows\\PLA\\*.exe", "?:\\Windows\\Migration\\*.exe",
+    "?:\\Windows\\debug\\*.exe", "?:\\Windows\\Cursors\\*.exe", "?:\\Windows\\Containers\\*.exe",
+    "?:\\Windows\\Boot\\*.exe", "?:\\Windows\\bcastdvr\\*.exe", "?:\\Windows\\assembly\\*.exe",
+    "?:\\Windows\\TextInput\\*.exe", "?:\\Windows\\security\\*.exe", "?:\\Windows\\schemas\\*.exe",
+    "?:\\Windows\\SchCache\\*.exe", "?:\\Windows\\Resources\\*.exe", "?:\\Windows\\rescache\\*.exe",
+    "?:\\Windows\\Provisioning\\*.exe", "?:\\Windows\\PrintDialog\\*.exe", "?:\\Windows\\PolicyDefinitions\\*.exe",
+    "?:\\Windows\\media\\*.exe", "?:\\Windows\\Globalization\\*.exe", "?:\\Windows\\L2Schemas\\*.exe",
+    "?:\\Windows\\LiveKernelReports\\*.exe", "?:\\Windows\\ModemLogs\\*.exe",
+    "?:\\Windows\\ImmersiveControlPanel\\*.exe"
+  ) and
+  
+  not process.name : (
+    "SpeechUXWiz.exe", "SystemSettings.exe", "TrustedInstaller.exe",
+    "PrintDialog.exe", "MpSigStub.exe", "LMS.exe", "mpam-*.exe"
+  ) and
+  not process.executable :
+            ("?:\\Intel\\Wireless\\WUSetupLauncher.exe",
+             "?:\\Intel\\Wireless\\Setup.exe",
+             "?:\\Intel\\Move Mouse.exe",
+             "?:\\windows\\Panther\\DiagTrackRunner.exe",
+             "?:\\Windows\\servicing\\GC64\\tzupd.exe",
+             "?:\\Users\\Public\\res\\RemoteLite.exe",
+             "?:\\Users\\Public\\IBM\\ClientSolutions\\*.exe",
+             "?:\\Users\\Public\\Documents\\syspin.exe",
+             "?:\\Users\\Public\\res\\FileWatcher.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-program-files-directory-masquerading.asciidoc
new file mode 100644
index 0000000000..7f2bf0392e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-program-files-directory-masquerading.asciidoc
@@ -0,0 +1,152 @@
+[[prebuilt-rule-8-17-11-program-files-directory-masquerading]]
+=== Program Files Directory Masquerading
+
+Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Program Files Directory Masquerading*
+
+
+The Program Files directories in Windows are trusted locations for legitimate software. Adversaries may exploit this trust by creating similarly named directories to execute malicious files, bypassing security measures. The detection rule identifies suspicious executions from these masquerading paths, excluding known legitimate directories, to flag potential threats. This helps in identifying defense evasion tactics used by attackers.
+
+
+*Possible investigation steps*
+
+
+- Review the process executable path to confirm if it matches any known masquerading patterns, such as unexpected directories containing "Program Files" in their path.
+- Check the parent process of the suspicious executable to determine how it was launched and assess if the parent process is legitimate or potentially malicious.
+- Investigate the user account associated with the process execution to determine if it has low privileges and if the activity aligns with typical user behavior.
+- Correlate the event with other security logs or alerts from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related suspicious activities or patterns.
+- Examine the file hash of the executable to see if it matches known malware signatures or if it has been flagged in threat intelligence databases.
+- Assess the network activity associated with the process to identify any unusual outbound connections that could indicate data exfiltration or command-and-control communication.
+
+
+*False positive analysis*
+
+
+- Legitimate software installations or updates may create temporary directories resembling Program Files paths. Users can monitor installation logs and exclude these specific paths if they are verified as part of a legitimate process.
+- Some enterprise applications may use custom directories that mimic Program Files for compatibility reasons. IT administrators should document these paths and add them to the exclusion list to prevent false alerts.
+- Development environments might create test directories with similar naming conventions. Developers should ensure these paths are excluded during active development phases to avoid unnecessary alerts.
+- Security tools or scripts that perform regular checks or updates might execute from non-standard directories. Verify these tools and add their execution paths to the exception list if they are confirmed safe.
+- Backup or recovery software might temporarily use directories that resemble Program Files for storing executable files. Confirm the legitimacy of these operations and exclude the paths if they are part of routine backup processes.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
+- Terminate any suspicious processes identified as executing from masquerading directories to halt any ongoing malicious actions.
+- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any malicious files or remnants.
+- Review and restore any altered system configurations or settings to their original state to ensure system integrity.
+- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected.
+- Implement additional monitoring on the affected system and similar environments to detect any recurrence of the threat or similar tactics.
+- Update security policies and access controls to prevent unauthorized creation of directories that mimic trusted paths, enhancing defenses against similar masquerading attempts.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.executable : (
+    "C:\\*Program*Files*\\*.exe",
+    "\\Device\\HarddiskVolume?\\*Program*Files*\\*.exe"
+  ) and
+  not process.executable : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Users\\*.exe",
+        "?:\\ProgramData\\*.exe",
+        "?:\\Windows\\Downloaded Program Files\\*.exe",
+        "?:\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
+        "?:\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
+  ) and
+  not (
+    event.dataset == "crowdstrike.fdr" and
+      process.executable : (
+        "\\Device\\HarddiskVolume?\\Program Files\\*.exe",
+        "\\Device\\HarddiskVolume?\\Program Files (x86)\\*.exe",
+        "\\Device\\HarddiskVolume?\\Users\\*.exe",
+        "\\Device\\HarddiskVolume?\\ProgramData\\*.exe",
+        "\\Device\\HarddiskVolume?\\Windows\\Downloaded Program Files\\*.exe",
+        "\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
+        "\\Device\\HarddiskVolume?\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
+      )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation.asciidoc
new file mode 100644
index 0000000000..cccbb97624
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation.asciidoc
@@ -0,0 +1,110 @@
+[[prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation]]
+=== Rapid7 Threat Command CVEs Correlation
+
+This rule is triggered when CVEs collected from the Rapid7 Threat Command Integration have a match against vulnerabilities that were found in the customer environment.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 30m
+
+*Searches indices from*: now-35m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 1000
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://docs.elastic.co/integrations/ti_rapid7_threat_command
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Data Source: Windows
+* Data Source: Network
+* Data Source: Rapid7 Threat Command
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+* Use Case: Vulnerability
+* Use Case: Asset Visibility
+* Use Case: Continuous Monitoring
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Rapid7 Threat Command CVEs Correlation*
+
+
+Rapid7 Threat Command CVEs Correlation rule allows matching CVEs from user indices within the vulnerabilities collected from Rapid7 Threat Command integrations.
+
+The matches will be based on the latest values of CVEs from the last 180 days. So it's essential to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.
+
+If a vulnerability matches a local observation, the following enriched fields will be generated to identify the vulnerability, field, and type matched.
+
+- `threat.indicator.matched.atomic` - this identifies the atomic vulnerability that matched the local observation
+- `threat.indicator.matched.field` - this identifies the vulnerability field that matched the local observation
+- `threat.indicator.matched.type` - this identifies the vulnerability type that matched the local observation
+
+Additional investigation can be done by reviewing the source of the activity and considering the history of the vulnerability that was matched. This can help understand if the activity is related to legitimate behavior.
+
+- Investigation can be validated and reviewed based on the data that was matched and by viewing the source of that activity.
+- Consider the history of the vulnerability that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.
+- Consider the user and their role within the company: is this something related to their job or work function?
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+*Additional notes*
+
+
+For information on troubleshooting the maximum alerts warning please refer to this https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts[guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+vulnerability.id : *
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rare-connection-to-webdav-target.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rare-connection-to-webdav-target.asciidoc
new file mode 100644
index 0000000000..1f36dd11aa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-rare-connection-to-webdav-target.asciidoc
@@ -0,0 +1,105 @@
+[[prebuilt-rule-8-17-11-rare-connection-to-webdav-target]]
+=== Rare Connection to WebDAV Target
+
+Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-3660s ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1187/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Rare Connection to WebDAV Target*
+
+
+
+*Possible investigation steps*
+
+
+- Examine the reputation of the destination domain or IP address.
+- Verify if the target user opened any attachments or clicked links pointing to the same target within seconds from the alert timestamp.
+- Correlate the findings with other security logs and alerts to identify any patterns or additional indicators of compromise related to the potential relay attack.
+
+
+*False positive analysis*
+
+
+- User accessing legit WebDAV resources.
+
+
+*Response and remediation*
+
+
+- Conduct a password reset for the target account that may have been compromised or are at risk, ensuring the use of strong, unique passwords.
+- Verify whether other users were targeted but did not open the lure..
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
+- Conduct a post-incident review to identify any gaps in security controls and update policies or procedures to prevent recurrence, ensuring lessons learned are applied to improve overall security posture.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-*
+| where @timestamp > NOW() - 8 hours
+| WHERE event.category == "process" and event.type == "start" and process.name == "rundll32.exe" and process.command_line like "*DavSetCookie*"
+| keep host.id, process.command_line, user.name
+| grok process.command_line """(?<target>DavSetCookie .* http)"""
+| eval webdav_target = REPLACE(target, "(DavSetCookie | http)", "")
+| where webdav_target is not null and webdav_target rlike """(([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,3}(@SSL.*)*|(\d{1,3}\.){3}\d{1,3})""" and not webdav_target in ("www.google.com@SSL", "www.elastic.co@SSL") and not webdav_target rlike """(10\.(\d{1,3}\.){2}\d{1,3}|172\.(1[6-9]|2\d|3[0-1])\.(\d{1,3}\.)\d{1,3}|192\.168\.(\d{1,3}\.)\d{1,3})"""
+| stats total = count(*), unique_count_host = count_distinct(host.id), hosts = VALUES(host.id), users = VALUES(user.name) by webdav_target
+| where unique_count_host == 1 and total <= 3
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Forced Authentication
+** ID: T1187
+** Reference URL: https://attack.mitre.org/techniques/T1187/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer.asciidoc
new file mode 100644
index 0000000000..f04ec6b5c9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer]]
+=== Remote File Copy via TeamViewer
+
+Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote File Copy via TeamViewer*
+
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.
+
+TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Contact the user to gather information about who and why was conducting the remote access.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this access.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and process.name : "TeamViewer.exe" and
+  file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") and
+  not 
+  (
+    file.path : (
+      "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.js",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\TeamViewer\\update.exe",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\?\\TeamViewer\\update.exe",
+      "?:\\Users\\*\\AppData\\Local\\TeamViewer\\CustomConfigs\\???????\\TeamViewer_Resource_??.dll",
+      "?:\\Users\\*\\AppData\\Local\\TeamViewer\\CustomConfigs\\???????\\TeamViewer*.exe"
+    ) and process.code_signature.trusted == true
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter.asciidoc
new file mode 100644
index 0000000000..dee0a76ef3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter]]
+=== Renamed AutoIt Scripts Interpreter
+
+Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Renamed AutoIt Scripts Interpreter*
+
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+AutoIt is a scripting language and tool for automating tasks on Microsoft Windows operating systems. Due to its capabilities, malicious threat actors can abuse it to create malicious scripts and distribute malware.
+
+This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name.asciidoc
new file mode 100644
index 0000000000..e5c4320bd6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name]]
+=== Renamed Utility Executed with Short Program Name
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 214
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Renamed Utility Executed with Short Program Name*
+
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and length(process.name) > 0 and
+ length(process.name) == 5 and length(process.pe.original_file_name) > 5
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
new file mode 100644
index 0000000000..91b410aba1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
@@ -0,0 +1,167 @@
+[[prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user]]
+=== Suspicious Activity via Auth Broker On-Behalf-of Principal User
+
+Identifies suspicious activity from the Microsoft Authentication Broker in Microsoft Entra ID sign-in logs. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to register a device and access Microsoft services as a user. The pattern includes sign-ins from multiple IPs across services (Microsoft Graph, DRS, AAD) using the Authentication Broker client on behalf of a principal user.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-1h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in Logs
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
+* Tactic: Persistence
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Activity via Auth Broker On-Behalf-of Principal User*
+
+
+This rule identifies suspicious activity from the Microsoft Authentication Broker where the same identity accesses Microsoft Graph at least twice and either Device Registration Service (DRS) or Azure Active Directory (AAD) once — all from multiple unique source IPs within a short window. This behavior may indicate the use of a previously phished refresh token to impersonate a user and register a device, followed by an attempt to acquire a Primary Refresh Token (PRT) for persistent access.
+
+
+*Possible Investigation Steps:*
+
+
+- `target`: The user principal name targeted by the authentication broker. Investigate whether this user has recently registered a device, signed in from new IPs, or has had recent password resets or MFA changes.
+- `azure.signinlogs.identity`: The identity value the broker is acting on behalf of. This may be useful when correlating to device registration records or audit events tied to object IDs.
+- `ips`: Analyze the list of unique IP addresses used within the 30-minute window. Determine whether these originate from different geographic regions, cloud providers, or anonymizing infrastructure (e.g., Tor or VPNs).
+- `incoming_token_type`: Look for values like `"refreshToken"` or `"none"`, which may indicate token replay. `"refreshToken"` suggests broker-based reauthentication using stolen credentials.
+- `user_agents`: Check for mixed user agent strings. Automation tools (e.g., `python-requests`) alongside browser-based agents (e.g., Chrome on macOS) may indicate scripted misuse of tokens.
+- `OS`: Review for inconsistencies. For example, if both `Windows` and `MacOs` appear during a short time span for the same user, this may point to token abuse across multiple environments.
+- `target_time_window`: Use the truncated time window to pivot into raw `azure.signinlogs` to reconstruct the full sequence of resource access events, including exact timestamps and service targets.
+- `azure.auditlogs` to check for device join or registration events around the same timeframe.
+- `azure.identityprotection` to identify correlated risk detections, such as anonymized IP access or token replay.
+- Any additional sign-ins from the `ips` involved, even outside the broker, to determine if tokens have been reused elsewhere.
+
+
+*False Positive Analysis*
+
+
+- This pattern may occur if the user is registering a new device legitimately from two networks (e.g., mobile hotspot and home).
+- Security software (e.g., endpoint detection tools) or identity clients may produce rapid Graph and DRS access in rare edge cases.
+- Developers or IT administrators working across environments may also produce similar behavior.
+
+
+*Response and Remediation*
+
+
+- If confirmed unauthorized, revoke all refresh tokens for the affected user and remove any devices registered during this session.
+- Notify the user and determine whether the device join or authentication activity was expected.
+- Audit Conditional Access and broker permissions (`29d9ed98-a469-4536-ade2-f981bc1d605e`) to ensure policies enforce strict access controls.
+- Consider blocking token-based reauthentication to Microsoft Graph and DRS from suspicious locations or user agents.
+- Continue monitoring for follow-on activity like lateral movement or privilege escalation.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Sign-In Logs*
+
+This rule requires the Microsoft Entra ID Sign-In Logs integration be enabled and configured to collect sign-in logs. In Entra ID, sign-in logs must be enabled and streaming to the Event Hub used for the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-azure.signinlogs* metadata _id, _version, _index
+
+// filter for Microsoft Entra ID Sign-in Logs
+| where event.dataset == "azure.signinlogs"
+
+    // filters on member principals, excluding service principals
+    and azure.signinlogs.properties.user_type == "Member"
+    and source.ip is not null
+    and azure.signinlogs.identity is not null
+    and azure.signinlogs.properties.user_principal_name is not null
+    and event.outcome == "success"
+
+    // filter for successful sign-ins to Microsoft Graph and DRS/AAD from the Microsoft Authentication Broker
+    and (azure.signinlogs.properties.app_display_name == "Microsoft Authentication Broker" or azure.signinlogs.properties.app_id == "29d9ed98-a469-4536-ade2-f981bc1d605e")
+    and azure.signinlogs.properties.resource_display_name in ("Device Registration Service", "Microsoft Graph", "Windows Azure Active Directory")
+
+// keep relevant fields
+| keep @timestamp, azure.signinlogs.identity, source.ip, azure.signinlogs.properties.app_display_name, azure.signinlogs.properties.resource_display_name, azure.signinlogs.properties.user_principal_name, azure.signinlogs.properties.incoming_token_type, user_agent.original, azure.signinlogs.properties.device_detail.operating_system
+
+// aggregate by 30-minute time window
+| eval target_time_window = DATE_TRUNC(30 minutes, @timestamp)
+
+// case statements to track which are MS Graph, DRS, and AAD access
+| eval ms_graph = case(azure.signinlogs.properties.resource_display_name == "Microsoft Graph", source.ip, null), drs = case(azure.signinlogs.properties.resource_display_name == "Device Registration Service", source.ip, null), aad = case(azure.signinlogs.properties.resource_display_name == "Windows Azure Active Directory", source.ip, null)
+
+// aggregate by principal and time window
+// store token types, target user, unique source IPs, and user agents in arrays for investigation
+| stats is_ms_graph = COUNT_DISTINCT(ms_graph), is_drs = COUNT_DISTINCT(drs), is_aad = COUNT_DISTINCT(aad), unique_src_ip = COUNT_DISTINCT(source.ip), ips = VALUES(source.ip), incoming_token_type = VALUES(azure.signinlogs.properties.incoming_token_type), target = VALUES(azure.signinlogs.properties.user_principal_name), user_agents = VALUES(user_agent.original), OS = VALUES(azure.signinlogs.properties.device_detail.operating_system) by azure.signinlogs.identity, target_time_window
+
+// filter for cases with multiple unique source IPs, and at least one DRS or AAD access, and multiple MS Graph accesses
+| where unique_src_ip >= 2 and (is_drs >= 1 or is_aad >= 1) and is_ms_graph >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Device Registration
+** ID: T1098.005
+** Reference URL: https://attack.mitre.org/techniques/T1098/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll.asciidoc
new file mode 100644
index 0000000000..7f764cf252
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll.asciidoc
@@ -0,0 +1,171 @@
+[[prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll]]
+=== Suspicious Antimalware Scan Interface DLL
+
+Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-m365_defender.event-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 318
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Antimalware Scan Interface DLL*
+
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the process that created the DLL and which account was used.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the execution of scripts and macros after the registry modification.
+- Investigate other processes launched from the directory that the DLL was created.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
+  file.name : ("amsi.dll", "amsi") and
+  not file.path : (
+    "?:\\$SysReset\\CloudImage\\Package_for_RollupFix*",
+    "?:\\Windows\\system32\\amsi.dll",
+    "?:\\Windows\\Syswow64\\amsi.dll",
+    "?:\\$WINDOWS.~BT\\DUImageSandbox\\*",
+    "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*",
+    "?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*",
+    "?:\\$WINDOWS.~BT\\Work\\*\\*",
+    "?:\\$WINDOWS.~BT\\Store\\Offline\\File\\C$\\Windows\\SoftwareDistribution\\Download.bak\\*",
+    "?:\\Windows\\CbsTemp\\*\\f\\amsi.dll",
+    "?:\\Windows\\SoftwareDistribution\\Download\\*",
+    "?:\\Windows\\WinSxS\\amd64_microsoft-antimalware-scan-interface_*\\amsi.dll"
+  ) and
+  not
+  (
+    process.executable : "C:\\Windows\\System32\\wbengine.exe" and
+    file.path : (
+      "\\Device\\HarddiskVolume??\\Windows\\system32\\amsi.dll",
+      "\\Device\\HarddiskVolume??\\Windows\\syswow64\\amsi.dll",
+      "\\Device\\HarddiskVolume??\\Windows\\WinSxS\\*\\amsi.dll",
+      "\\\\?\\Volume{*}\\Windows\\WinSxS\\*\\amsi.dll",
+      "\\\\?\\Volume{*}\\Windows\\system32\\amsi.dll",
+      "\\\\?\\Volume{*}\\Windows\\syswow64\\amsi.dll"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-communication-app-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-communication-app-child-process.asciidoc
new file mode 100644
index 0000000000..d2bcd82997
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-communication-app-child-process.asciidoc
@@ -0,0 +1,316 @@
+[[prebuilt-rule-8-17-11-suspicious-communication-app-child-process]]
+=== Suspicious Communication App Child Process
+
+Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 10
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Communication App Child Process*
+
+
+Communication apps like Slack, WebEx, and Teams are integral to modern workflows, facilitating collaboration. However, adversaries can exploit these apps by spawning unauthorized child processes, potentially masquerading as legitimate ones or exploiting vulnerabilities to execute malicious code. The detection rule identifies such anomalies by monitoring child processes of these apps, ensuring they are trusted and signed by recognized entities. This helps in identifying potential threats that deviate from expected behavior, thus safeguarding against unauthorized access and execution.
+
+
+*Possible investigation steps*
+
+
+- Review the process details, including the parent process name and executable path, to confirm if the child process is expected or unusual for the communication app in question.
+- Check the code signature of the suspicious child process to determine if it is trusted and signed by a recognized entity, as specified in the query.
+- Investigate the command line arguments of the child process to identify any potentially malicious or unexpected commands being executed.
+- Correlate the event with other logs or alerts to identify any related suspicious activities or patterns, such as repeated unauthorized child process executions.
+- Assess the user account associated with the process to determine if it has been compromised or is exhibiting unusual behavior.
+- Examine the network activity of the affected system to identify any suspicious outbound connections that may indicate data exfiltration or communication with a command and control server.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may trigger the rule if they spawn child processes from communication apps. Users can create exceptions for known update processes by verifying their code signatures and paths.
+- Custom scripts or automation tools that interact with communication apps might be flagged. Users should ensure these scripts are signed and located in trusted directories, then add them to the exception list.
+- Certain administrative tasks, such as using command-line tools like cmd.exe or powershell.exe, may be mistakenly identified as suspicious. Users can whitelist specific command lines or arguments that are regularly used in their environment.
+- Some third-party integrations with communication apps may generate child processes that are not inherently malicious. Users should verify the legitimacy of these integrations and add them to the trusted list if they are deemed safe.
+- Regularly review and update the list of trusted code signatures and executable paths to ensure that legitimate processes are not inadvertently flagged as suspicious.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or execution of malicious code.
+- Terminate any suspicious child processes identified by the detection rule that are not signed by recognized entities or are executing from unexpected locations.
+- Conduct a thorough review of the affected communication app's logs and configurations to identify any unauthorized changes or access patterns.
+- Restore the affected system from a known good backup if malicious activity is confirmed, ensuring that the backup is free from compromise.
+- Update the communication app and all related software to the latest versions to patch any known vulnerabilities that may have been exploited.
+- Implement application whitelisting to ensure only trusted and signed applications can execute, reducing the risk of similar threats.
+- Escalate the incident to the security operations center (SOC) or relevant security team for further investigation and to assess the potential impact on other systems.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    /* Slack */
+    (process.parent.name : "slack.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
+            "?:\\Users\\*\\AppData\\Roaming\\Zoom\\bin*\\Zoom.exe",
+            "?:\\Windows\\System32\\rundll32.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
+            "?:\\Windows\\System32\\notepad.exe",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Slack Technologies, Inc.",
+            "Slack Technologies, LLC"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          (process.name : "powershell.exe" and process.command_line : "powershell.exe -c Invoke-WebRequest -Uri https://slackb.com/*") or
+          (process.name : "cmd.exe" and process.command_line : "C:\\WINDOWS\\system32\\cmd.exe /d /s /c \"%windir%\\System32\\rundll32.exe User32.dll,SetFocus 0\"")
+        )
+      )
+    ) or
+
+    /* WebEx */
+    (process.parent.name : ("CiscoCollabHost.exe", "WebexHost.exe") and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
+            "?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\opera.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Cisco Systems, Inc.",
+            "Cisco WebEx LLC",
+            "Cisco Systems Inc."
+          ) and process.code_signature.trusted == true
+        )
+      )
+    ) or
+
+    /* Teams */
+    (process.parent.name : "Teams.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\BrowserCore\\BrowserCore.exe",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Microsoft Corporation",
+            "Microsoft 3rd Party Application Component"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          (process.name : "taskkill.exe" and process.args : "Teams.exe")
+        )
+      )
+    ) or
+
+    /* Discord */
+    (process.parent.name : "Discord.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Windows\\System32\\reg.exe",
+            "?:\\Windows\\SysWOW64\\reg.exe",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Discord Inc."
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.name : "cmd.exe" and
+          (
+            process.command_line : (
+              "C:\\WINDOWS\\system32\\cmd.exe /d /s /c \"chcp\"",
+              "C:\\WINDOWS\\system32\\cmd.exe /q /d /s /c \"C:\\Program^ Files\\NVIDIA^ Corporation\\NVSMI\\nvidia-smi.exe\""
+            ) or
+            process.args : (
+              "C:\\WINDOWS/System32/nvidia-smi.exe",
+              "C:\\WINDOWS\\System32\\nvidia-smi.exe",
+              "C:\\Windows\\System32\\DriverStore\\FileRepository/*/nvidia-smi.exe*"
+            )
+          )
+        )
+      )
+    ) or
+
+    /* WhatsApp */
+    (process.parent.name : "Whatsapp.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\System32\\reg.exe",
+            "?:\\Windows\\SysWOW64\\reg.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "WhatsApp LLC",
+            "WhatsApp, Inc",
+            "24803D75-212C-471A-BC57-9EF86AB91435"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          (process.name : "cmd.exe" and process.command_line : "C:\\Windows\\system32\\cmd.exe /d /s /c \"C:\\Windows\\system32\\wbem\\wmic.exe*")
+        )
+      )
+    ) or
+
+    /* Zoom */
+    (process.parent.name : "Zoom.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+            "?:\\Users\\*\\AppData\\Local\\Island\\Island\\Application\\Island.exe",
+            "?:\\Users\\*\\AppData\\Local\\Mozilla Firefox\\firefox.exe",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Zoom Video Communications, Inc."
+          ) and process.code_signature.trusted == true
+        )
+      )
+    ) or
+
+    /* Thunderbird */
+    (process.parent.name : "thunderbird.exe" and not
+      (
+        (
+          process.executable : (
+            "?:\\Program Files\\*",
+            "?:\\Program Files (x86)\\*",
+            "?:\\Windows\\System32\\WerFault.exe",
+            "?:\\Windows\\SysWOW64\\WerFault.exe",
+            "?:\\Windows\\splwow64.exe"
+          ) and process.code_signature.trusted == true
+        ) or
+        (
+          process.code_signature.subject_name : (
+            "Mozilla Corporation"
+          ) and process.code_signature.trusted == true
+        )
+      )
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Compromise Host Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
new file mode 100644
index 0000000000..98bc02b6c1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -0,0 +1,235 @@
+[[prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation]]
+=== Suspicious DLL Loaded for Persistence or Privilege Escalation
+
+Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.library-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://itm4n.github.io/windows-dll-hijacking-clarified/
+* http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
+* https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
+* https://shellz.club/2020/10/16/edgegdi-dll-for-persistence-and-lateral-movement.html
+* https://windows-internals.com/faxing-your-way-to-system/
+* http://waleedassar.blogspot.com/2013/01/wow64logdll.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation*
+
+
+Attackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.
+
+
+*Possible investigation steps*
+
+
+- Examine the DLL signature and identify the process that created it.
+  - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve the DLL and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+(event.category : ("driver", "library") or (event.category == "process" and event.action : "Image loaded*")) and
+(
+  /* compatible with Elastic Endpoint Library Events */
+  (
+    ?dll.name : (
+        "wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+        "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+        "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "TPPCOIPW32.dll", 
+        "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll"
+    )
+    and (
+      ?dll.code_signature.trusted != true or
+      ?dll.code_signature.exists != true or
+      (
+        dll.code_signature.trusted == true and
+          not dll.code_signature.subject_name : ("Microsoft Windows", "Microsoft Corporation", "Microsoft Windows Publisher")
+      )
+  ) or
+   /* oci.dll is too noisy due to unsigned Oracle related DLL loaded from random dirs */
+  (
+   (?dll.path : "?:\\Windows\\*\\oci.dll" and process.executable : "?:\\Windows\\*.exe" and 
+    (?dll.code_signature.trusted != true or ?dll.code_signature.exists != true)) or 
+    
+   (file.path : "?:\\Windows\\*\\oci.dll" and not file.code_signature.status == "Valid" and process.executable : "?:\\Windows\\*.exe")
+   ) or 
+
+  /* compatible with Sysmon EventID 7 - Image Load */
+  (file.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+               "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+               "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "TPPCOIPW32.dll", 
+               "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll") and 
+   not file.hash.sha256 : 
+            ("6e837794fc282446906c36d681958f2f6212043fc117c716936920be166a700f", 
+             "b14e4954e8cca060ffeb57f2458b6a3a39c7d2f27e94391cbcea5387652f21a4", 
+             "c258d90acd006fa109dc6b748008edbb196d6168bc75ace0de0de54a4db46662") and 
+   not file.code_signature.status == "Valid")
+  ) and
+  not
+  (
+    ?dll.path : (
+      "?:\\Windows\\System32\\wbemcomn.dll",
+      "?:\\Windows\\SysWOW64\\wbemcomn.dll",
+      "?:\\Windows\\System32\\windowsperformancerecordercontrol.dll",
+      "?:\\Windows\\System32\\wlanhlp.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\wbemcomn.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\System32\\wbemcomn.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\wlanhlp.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\System32\\wlanhlp.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\SysWOW64\\windowsperformancerecordercontrol.dll", 
+      "\\Device\\HarddiskVolume?\\Windows\\System32\\windowsperformancerecordercontrol.dll", 
+      "C:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\windowsperformancerecordercontrol.dll", 
+      "C:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\windowsperformancerecordercontrol.dll", 
+      "\\Device\\vmsmb\\VSMB-{*}\\os\\windows\\system32\\*.dll"
+    ) or
+    file.path : (
+      "?:\\Windows\\System32\\wbemcomn.dll",
+      "?:\\Windows\\SysWOW64\\wbemcomn.dll",
+      "?:\\Windows\\System32\\windowsperformancerecordercontrol.dll",
+      "?:\\Windows\\System32\\wlanhlp.dll", 
+      "C:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\windowsperformancerecordercontrol.dll", 
+      "C:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\wbemcomn.dll", 
+      "\\Device\\vmsmb\\VSMB-{*}\\os\\windows\\system32\\*.dll"
+    )
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process.asciidoc
new file mode 100644
index 0000000000..e599195a3c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process.asciidoc
@@ -0,0 +1,149 @@
+[[prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process]]
+=== Suspicious Endpoint Security Parent Process
+
+A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 318
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Endpoint Security Parent Process*
+
+
+Endpoint security solutions, like Elastic and Microsoft Defender, monitor and protect systems by analyzing process behaviors. Adversaries may exploit these processes through techniques like process hollowing, where malicious code is injected into legitimate processes to evade detection. The detection rule identifies anomalies by flagging unexpected parent processes of security executables, excluding known benign paths and arguments, thus highlighting potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details for the flagged executable (e.g., esensor.exe or elastic-endpoint.exe) to understand its expected behavior and any recent changes in its configuration or deployment.
+- Examine the parent process executable path and name to determine if it is a known legitimate process or potentially malicious. Pay special attention to paths not listed in the known benign paths, such as those outside "?:\Program Files\Elastic\*" or "?:\Windows\System32\*".
+- Investigate the command-line arguments used by the parent process to identify any unusual or suspicious patterns that could indicate malicious activity, especially if they do not match the benign arguments like "test", "version", or "status".
+- Check the historical activity of the parent process to see if it has been involved in other suspicious activities or if it has a history of spawning security-related processes.
+- Correlate the alert with other security events or logs from data sources like Elastic Endgame, Microsoft Defender for Endpoint, or Sysmon to gather additional context and identify any related suspicious activities.
+- Assess the risk and impact of the alert by considering the environment, the criticality of the affected systems, and any potential data exposure or operational disruption.
+
+
+*False positive analysis*
+
+
+- Security tools or scripts that automate tasks may trigger false positives if they launch endpoint security processes with unexpected parent processes. To manage this, identify and document these tools, then add their parent executable paths to the exclusion list.
+- System administrators or IT personnel may use command-line tools like PowerShell or cmd.exe for legitimate maintenance tasks. If these tasks frequently trigger alerts, consider adding specific command-line arguments used in these tasks to the exclusion list.
+- Software updates or installations might temporarily cause unexpected parent processes for security executables. Monitor these activities and, if they are routine and verified, add the associated parent executable paths to the exclusion list.
+- Custom scripts or third-party applications that interact with security processes can also lead to false positives. Review these scripts or applications, and if they are deemed safe, include their parent executable paths in the exclusion list.
+- Regularly review and update the exclusion list to ensure it reflects the current environment and operational practices, minimizing the risk of overlooking new legitimate processes.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
+- Terminate the suspicious process identified by the alert to stop any ongoing malicious activity and prevent further code execution.
+- Conduct a forensic analysis of the affected system to identify any additional indicators of compromise, such as unauthorized changes or additional malicious files.
+- Restore the system from a known good backup if any malicious activity or unauthorized changes are confirmed, ensuring that the backup is clean and uncompromised.
+- Update endpoint security solutions and apply any available patches to address vulnerabilities that may have been exploited by the adversary.
+- Monitor the network and systems for any signs of re-infection or similar suspicious activities, using enhanced logging and alerting based on the identified threat indicators.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems may be affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("esensor.exe", "elastic-endpoint.exe") and
+  process.parent.executable != null and
+  /* add FPs here */
+  not process.parent.executable : (
+        "?:\\Program Files\\Elastic\\*",
+        "?:\\Windows\\System32\\services.exe",
+        "?:\\Windows\\System32\\WerFault*.exe",
+        "?:\\Windows\\System32\\wermgr.exe",
+        "?:\\Windows\\explorer.exe"
+  ) and
+  not (
+    process.parent.executable : (
+        "?:\\Windows\\System32\\cmd.exe",
+        "?:\\Windows\\System32\\SecurityHealthHost.exe",
+        "?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+    ) and
+    process.args : (
+        "test", "version",
+        "top", "run",
+        "*help", "status",
+        "upgrade", "/launch",
+        "/enable"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-kernel-feature-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-kernel-feature-activity.asciidoc
new file mode 100644
index 0000000000..ab39f88508
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-kernel-feature-activity.asciidoc
@@ -0,0 +1,93 @@
+[[prebuilt-rule-8-17-11-suspicious-kernel-feature-activity]]
+=== Suspicious Kernel Feature Activity
+
+This rule detects the modification and reading of kernel features through built-in commands. Attackers may collect information, disable or weaken Linux kernel protections. For example, an attacker may modify ASLR protection by disabling kernel.randomize_va_space, allow ptrace by setting kernel.yama.ptrace_scope to 0, or disable the NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to impair defenses and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Discovery
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.command_line : (
+  "*/etc/sysctl.conf*", "*/etc/sysctl.d/*", "*/proc/sys/kernel/nmi_watchdog*",
+  "*/proc/sys/vm/nr_hugepages*", "*/proc/sys/kernel/yama/ptrace_scope*",
+  "*/proc/sys/kernel/randomize_va_space*", "*/proc/sys/vm/drop_caches*",
+  "*/proc/sys/kernel/sysrq*", "*grsecurity*", "*exec-shield*",
+  "*kernel.randomize_va_space*", "*kernel.yama.ptrace_scope*",
+  "*kernel.nmi_watchdog*", "*vm.nr_hugepages*", "*vm.drop_caches*",
+  "*kernel.sysrq*"
+) and
+process.parent.executable != null and 
+(
+  (process.name == "tee" and process.args like "-*a*") or // also detects --append
+  (process.name == "cat" and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or
+  (process.name == "grep" and process.args_count == 3 and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or
+  (process.name == "sysctl" and process.args like ("*-w*", "*--write*", "*=*")) or
+  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and process.args : "*echo *")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
new file mode 100644
index 0000000000..06ad9c79b6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code]]
+=== Suspicious Microsoft 365 UserLoggedIn via OAuth Code
+
+Identifies sign-ins on behalf of a principal user to the Microsoft Graph API from multiple IPs using the Microsoft Authentication Broker or Visual Studio Code application. This behavior may indicate an adversary using a phished OAuth refresh token.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-1h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Microsoft 365 UserLoggedIn via OAuth Code*
+
+
+
+*Possible Investigation Steps:*
+
+
+- `o365.audit.UserId`: The identity value the application is acting on behalf of principal user.
+- `unique_ips`: Analyze the list of unique IP addresses used within the 30-minute window. Determine whether these originate from different geographic regions, cloud providers, or anonymizing infrastructure (e.g., Tor or VPNs).
+- `target_time_window`: Use the truncated time window to pivot into raw events to reconstruct the full sequence of resource access events, including exact timestamps and service targets.
+- `azure.auditlogs` to check for device join or registration events around the same timeframe.
+- `azure.identityprotection` to identify correlated risk detections, such as anonymized IP access or token replay.
+- Any additional sign-ins from the `ips` involved, even outside the broker, to determine if tokens have been reused elsewhere.
+
+
+*False Positive Analysis*
+
+
+- Developers or IT administrators working across environments may also produce similar behavior.
+
+
+*Response and Remediation*
+
+
+- If confirmed unauthorized, revoke all refresh tokens for the affected user and remove any devices registered during this session.
+- Notify the user and determine whether the device join or authentication activity was expected.
+- Audit Conditional Access and broker permissions (`29d9ed98-a469-4536-ade2-f981bc1d605e`) to ensure policies enforce strict access controls.
+- Consider blocking token-based reauthentication to Microsoft Graph and DRS from suspicious locations or user agents.
+- Continue monitoring for follow-on activity like lateral movement or privilege escalation.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-o365.audit-default*
+| WHERE event.dataset == "o365.audit" and event.action == "UserLoggedIn" and
+  source.ip is not null and o365.audit.UserId is not null and o365.audit.ApplicationId is not null and o365.audit.UserType in ("0", "2", "3", "10") and 
+
+  // filter for successful logon to Microsoft Graph and from the Microsoft Authentication Broker or Visual Studio Code
+  o365.audit.ApplicationId in ("aebc6443-996d-45c2-90f0-388ff96faa56", "29d9ed98-a469-4536-ade2-f981bc1d605e") and
+  o365.audit.ObjectId in ("00000003-0000-0000-c000-000000000000")
+
+// keep relevant fields only
+| keep @timestamp, o365.audit.UserId, source.ip, o365.audit.ApplicationId, o365.audit.ObjectId, o365.audit.ExtendedProperties.RequestType, source.as.organization.name, o365.audit.ExtendedProperties.ResultStatusDetail
+
+// case statements to track which are OAuth2 authorization request via redirect and which are related to OAuth2 code to token conversion
+| eval oauth_authorize = case(o365.audit.ExtendedProperties.RequestType == "OAuth2:Authorize" and o365.audit.ExtendedProperties.ResultStatusDetail == "Redirect", o365.audit.UserId, null), oauth_token = case(o365.audit.ExtendedProperties.RequestType == "OAuth2:Token", o365.audit.UserId, null)
+
+// split time to 30 minutes intervals
+| eval target_time_window = DATE_TRUNC(30 minutes, @timestamp)
+
+// aggregate by principal, applicationId, objectId and time window
+| stats unique_ips = COUNT_DISTINCT(source.ip), source_ips = VALUES(source.ip), appIds = VALUES(o365.audit.ApplicationId), asn = values(`source.as.organization.name`), is_oauth_token = COUNT_DISTINCT(oauth_token), is_oauth_authorize = COUNT_DISTINCT(oauth_authorize) by o365.audit.UserId, target_time_window, o365.audit.ApplicationId, o365.audit.ObjectId
+
+// filter for cases where the same appId is used by the same principal user to access the same object and from multiple addresses via OAuth2 token
+| where unique_ips >= 2 and is_oauth_authorize > 0 and is_oauth_token > 0
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-named-pipe-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-named-pipe-creation.asciidoc
new file mode 100644
index 0000000000..ff8796362b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-named-pipe-creation.asciidoc
@@ -0,0 +1,111 @@
+[[prebuilt-rule-8-17-11-suspicious-named-pipe-creation]]
+=== Suspicious Named Pipe Creation
+
+This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:mkfifo and
+process.parent.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
+process.args:((/dev/shm/* or /tmp/* or /var/tmp/*) and not /*fifo*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-path-mounted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-path-mounted.asciidoc
new file mode 100644
index 0000000000..236d0606e2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-path-mounted.asciidoc
@@ -0,0 +1,101 @@
+[[prebuilt-rule-8-17-11-suspicious-path-mounted]]
+=== Suspicious Path Mounted
+
+This rule detects suspicious paths mounted on Linux systems. The mount command is used to attach filesystems to the system, and attackers may use it to mount malicious filesystems or directories for data exfiltration or persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "mount" and 
+process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*", "/mount") and process.parent.executable != null and
+not (
+  process.parent.executable like ("/bin/*", "/usr/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*", "/usr/libexec/*") or
+  process.parent.name == "snapd"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-proc-maps-discovery.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-proc-maps-discovery.asciidoc
new file mode 100644
index 0000000000..f5a67c1a80
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-proc-maps-discovery.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-17-11-suspicious-proc-maps-discovery]]
+=== Suspicious /proc/maps Discovery
+
+Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/arget13/DDexec
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious /proc/maps Discovery*
+
+
+In Linux environments, the `/proc/*/maps` files provide detailed memory mapping of processes, crucial for system diagnostics. However, adversaries exploit this by reading these files to pinpoint memory addresses for malicious activities like code injection. The detection rule identifies suspicious reads of these files by monitoring specific command executions, such as `cat` or `grep`, initiated from common shell environments, flagging potential reconnaissance attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the process details, including the process name and arguments, to confirm if the access to /proc/*/maps was initiated by a legitimate user or application. Pay special attention to the process.name and process.args fields.
+- Check the process.entry_leader.name to determine the shell environment from which the command was executed, and assess if this aligns with typical user behavior or known scripts.
+- Investigate the user account associated with the process to determine if there are any signs of compromise or unusual activity, such as recent logins from unfamiliar IP addresses or changes in user permissions.
+- Examine the parent process and any related child processes to understand the broader context of the command execution, looking for any signs of a script or automated task that might have triggered the alert.
+- Correlate this event with other security alerts or logs from the same host or user to identify any patterns or sequences of suspicious activities that could indicate a larger attack or reconnaissance effort.
+
+
+*False positive analysis*
+
+
+- System diagnostics tools may read /proc/*/maps files as part of routine checks. Identify these tools and create exceptions for their processes to avoid unnecessary alerts.
+- Developers and system administrators might manually inspect /proc/*/maps during debugging or performance tuning. Establish a list of known users and processes that perform these actions regularly and exclude them from triggering the rule.
+- Automated scripts for monitoring or logging purposes could access /proc/*/maps files. Review these scripts and whitelist them if they are verified to be non-malicious.
+- Security software might access these files as part of its scanning operations. Confirm the legitimacy of such software and add it to an exception list to prevent false positives.
+- Consider the context of the process entry leader. If certain shell environments are used predominantly for legitimate administrative tasks, adjust the rule to reduce sensitivity for those specific environments.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent potential lateral movement by the adversary.
+- Terminate any suspicious processes identified as reading the `/proc/*/maps` files using commands like `cat` or `grep` from unauthorized shell environments.
+- Conduct a memory analysis on the affected system to identify any injected code or unauthorized modifications in the process memory.
+- Review and audit user accounts and permissions on the affected system to ensure that only authorized users have access to sensitive files and directories.
+- Implement stricter access controls and monitoring on `/proc/*/maps` files to limit exposure and detect unauthorized access attempts.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are compromised.
+- Update and enhance endpoint detection and response (EDR) solutions to improve monitoring and alerting for similar suspicious activities in the future.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.args like "/proc/*/maps"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
new file mode 100644
index 0000000000..1128bd1e3f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable]]
+=== Suspicious Process Execution via Renamed PsExec Executable
+
+Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Execution via Renamed PsExec Executable*
+
+
+PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
+
+This rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.
+
+
+*Possible investigation steps*
+
+
+- Check if the usage of this tool complies with the organization's administration policy.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Identify the target computer and its role in the IT environment.
+- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "psexesvc.exe" and not process.name : "PSEXESVC.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: System Services
+** ID: T1569
+** Reference URL: https://attack.mitre.org/techniques/T1569/
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files.asciidoc
new file mode 100644
index 0000000000..a0cc5e70bd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files]]
+=== Suspicious Renaming of ESXI Files
+
+Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 11
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Renaming of ESXI Files*
+
+
+VMware ESXi files are critical for virtual machine operations, storing configurations and states. Adversaries may rename these files to evade detection or disrupt services, a tactic known as masquerading. The detection rule identifies renaming events of specific VMware file types on Linux systems, flagging potential malicious activity by monitoring deviations from expected file extensions.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to identify the specific file that was renamed, including its original and new name, to understand the nature of the change.
+- Check the timestamp of the rename event to correlate it with other activities on the system, such as user logins or other file operations, to identify potential patterns or anomalies.
+- Investigate the user account or process responsible for the rename action by examining system logs or user activity to determine if the action was authorized or suspicious.
+- Analyze the system for any other recent rename events involving VMware-related files to assess if this is an isolated incident or part of a broader pattern.
+- Examine the system for signs of compromise or unauthorized access, such as unexpected processes, network connections, or changes in system configurations, to identify potential threats.
+- Consult with relevant stakeholders, such as system administrators or security teams, to verify if the rename action was part of a legitimate maintenance or operational task.
+
+
+*False positive analysis*
+
+
+- Routine maintenance or administrative tasks may involve renaming VMware ESXi files for organizational purposes. To manage this, identify and exclude specific users or processes that regularly perform these tasks from triggering alerts.
+- Automated backup or snapshot processes might rename files temporarily as part of their operation. Review and whitelist these processes to prevent unnecessary alerts.
+- Development or testing environments often involve frequent renaming of virtual machine files for configuration testing. Consider excluding these environments from the rule or setting up a separate monitoring profile with adjusted thresholds.
+- System updates or patches might include scripts that rename files as part of the update process. Verify and exclude these scripts if they are known and trusted.
+- Custom scripts or tools used by IT teams for managing virtual machines may rename files as part of their functionality. Ensure these scripts are documented and excluded from triggering the rule.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected Linux system from the network to prevent further unauthorized access or potential spread of malicious activity.
+- Verify the integrity of the renamed VMware ESXi files by comparing them with known good backups or snapshots, and restore any altered files from a secure backup if necessary.
+- Conduct a thorough review of recent system logs and user activity to identify any unauthorized access or actions that may have led to the file renaming.
+- Revert any unauthorized changes to system configurations or permissions that may have facilitated the renaming of critical files.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement additional monitoring on the affected system and similar environments to detect any further attempts at file masquerading or other suspicious activities.
+- Review and update access controls and permissions for VMware ESXi files to ensure only authorized users have the ability to rename or modify these files.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action == "rename" and
+file.Ext.original.name : ("*.vmdk", "*.vmx", "*.vmxf", "*.vmsd", "*.vmsn", "*.vswp", "*.vmss", "*.nvram", "*.vmem")
+and not file.name : ("*.vmdk", "*.vmx", "*.vmxf", "*.vmsd", "*.vmsn", "*.vswp", "*.vmss", "*.nvram", "*.vmem")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file.asciidoc
new file mode 100644
index 0000000000..350b302ece
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file]]
+=== Suspicious Renaming of ESXI index.html File
+
+Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 11
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Renaming of ESXI index.html File*
+
+
+VMware ESXi hosts use the index.html file within their web interface for management tasks. Adversaries may rename this file to evade detection or to replace it with a malicious version, facilitating unauthorized access or data exfiltration. The detection rule monitors Linux systems for renaming actions targeting this file in the VMware directory, flagging potential defense evasion attempts by correlating file path and event actions.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to confirm the file path and event action, ensuring the "rename" action occurred on the "index.html" file within the "/usr/lib/vmware/*" directory.
+- Check the timestamp of the rename event to determine when the activity occurred and correlate it with any other suspicious activities or alerts around the same time.
+- Identify the user or process responsible for the rename action by examining the associated user account and process details in the event logs.
+- Investigate the system's recent login history and user activity to identify any unauthorized access or anomalies that could be linked to the rename event.
+- Analyze the renamed file and any new files in the directory for signs of tampering or malicious content, using file integrity monitoring tools or antivirus scans.
+- Review network logs for any unusual outbound connections from the affected host that could indicate data exfiltration or communication with a command and control server.
+- Consider isolating the affected host from the network to prevent further potential malicious activity while the investigation is ongoing.
+
+
+*False positive analysis*
+
+
+- Routine maintenance or updates on VMware ESXi hosts may involve renaming the index.html file temporarily. Users can create exceptions for known maintenance windows to prevent unnecessary alerts.
+- Automated scripts or backup processes might rename the index.html file as part of their operations. Identify and whitelist these scripts or processes to avoid false positives.
+- System administrators may manually rename the index.html file for legitimate customization or troubleshooting purposes. Document and exclude these actions by specific user accounts or during specific time frames.
+- Security tools or monitoring solutions might trigger renaming actions as part of their scanning or remediation tasks. Verify and exclude these tools from the rule to reduce false alerts.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected VMware ESXi host from the network to prevent further unauthorized access or data exfiltration.
+- Verify the integrity of the index.html file by comparing it with a known good version from a trusted source to determine if it has been tampered with or replaced.
+- Restore the original index.html file from a secure backup if it has been altered or replaced, ensuring that the backup is from a time before the suspicious activity was detected.
+- Conduct a thorough review of recent access logs and system changes on the affected host to identify any unauthorized access or modifications that may have occurred.
+- Escalate the incident to the security operations team for further investigation and to determine if additional systems may be compromised.
+- Implement additional monitoring on the affected host and similar systems to detect any further attempts to rename or modify critical files.
+- Review and update access controls and permissions on the VMware ESXi host to ensure that only authorized personnel have the ability to modify critical system files.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.action == "rename" and file.name : "index.html" and
+file.Ext.original.path : "/usr/lib/vmware/*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process.asciidoc
new file mode 100644
index 0000000000..422e8bfa4b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process.asciidoc
@@ -0,0 +1,142 @@
+[[prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process]]
+=== Suspicious ScreenConnect Client Child Process
+
+Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Windows Security Event Logs
+* Data Source: Crowdstrike
+
+*Version*: 312
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious ScreenConnect Client Child Process*
+
+
+ScreenConnect, a remote access tool, facilitates legitimate remote support but can be exploited by adversaries to execute unauthorized commands. Malicious actors may spawn processes like PowerShell or cmd.exe via ScreenConnect to perform harmful activities. The detection rule identifies such suspicious child processes, focusing on unusual arguments and process names, indicating potential abuse of remote access capabilities.
+
+
+*Possible investigation steps*
+
+
+- Review the parent process name to confirm it is one of the ScreenConnect client processes listed in the query, such as ScreenConnect.ClientService.exe or ScreenConnect.WindowsClient.exe, to verify the source of the suspicious activity.
+- Examine the child process name and arguments, such as powershell.exe with encoded commands or cmd.exe with /c, to identify potentially malicious actions or commands being executed.
+- Check the network activity associated with the suspicious process, especially if the process arguments include network-related terms like *http* or *downloadstring*, to determine if there is any unauthorized data exfiltration or command and control communication.
+- Investigate the user account under which the suspicious process was executed to assess if the account has been compromised or is being misused.
+- Correlate the event with other security alerts or logs from data sources like Elastic Defend or Microsoft Defender for Endpoint to gather additional context and identify any related malicious activities.
+- Review the system's recent activity and changes, such as new scheduled tasks or services created by schtasks.exe or sc.exe, to identify any persistence mechanisms that may have been established by the attacker.
+
+
+*False positive analysis*
+
+
+- Legitimate IT support activities using ScreenConnect may trigger the rule when executing scripts or commands for maintenance. To manage this, identify and whitelist specific IT support accounts or IP addresses that regularly perform these actions.
+- Automated scripts or scheduled tasks that use ScreenConnect for routine operations might be flagged. Review and document these scripts, then create exceptions for known benign processes and arguments.
+- Software updates or installations initiated through ScreenConnect can appear suspicious. Maintain a list of approved software and update processes, and exclude these from the rule.
+- Internal security tools or monitoring solutions that leverage ScreenConnect for legitimate purposes may be detected. Verify these tools and add them to an exclusion list to prevent false positives.
+- Training sessions or demonstrations using ScreenConnect to showcase command-line tools could be misinterpreted as threats. Ensure these sessions are logged and recognized as non-threatening, and adjust the rule to accommodate these scenarios.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the attacker.
+- Terminate any suspicious processes identified in the alert, such as PowerShell, cmd.exe, or other flagged executables, to halt any ongoing malicious activity.
+- Review and revoke any unauthorized user accounts or privileges that may have been created or modified using tools like net.exe or schtasks.exe.
+- Conduct a thorough scan of the affected system using endpoint protection tools to identify and remove any malware or unauthorized software installed by the attacker.
+- Restore the system from a known good backup if any critical system files or configurations have been altered or compromised.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for ScreenConnect and other remote access tools to detect similar activities in the future, ensuring that alerts are promptly reviewed and acted upon.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name :
+                ("ScreenConnect.ClientService.exe",
+                 "ScreenConnect.WindowsClient.exe",
+                 "ScreenConnect.WindowsBackstageShell.exe",
+                 "ScreenConnect.WindowsFileManager.exe") and
+  (
+   (process.name : "powershell.exe" and
+    process.args : ("-enc", "-ec", "-e", "*downloadstring*", "*Reflection.Assembly*", "*http*")) or
+   (process.name : "cmd.exe" and process.args : "/c") or
+   (process.name : "net.exe" and process.args : "/add") or
+   (process.name : "schtasks.exe" and process.args : ("/create", "-create")) or
+   (process.name : "sc.exe" and process.args : "create") or
+   (process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
+   (process.name : "msiexec.exe" and process.args : ("/i", "-i") and
+    process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
+   process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe",
+                   "ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
+   )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-moved-or-copied.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-moved-or-copied.asciidoc
new file mode 100644
index 0000000000..b8f8140340
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-moved-or-copied.asciidoc
@@ -0,0 +1,191 @@
+[[prebuilt-rule-8-17-11-system-binary-moved-or-copied]]
+=== System Binary Moved or Copied
+
+This rule monitors for the copying or moving of a system binary. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
+* https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 17
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating System Binary Moved or Copied*
+
+
+System binaries are essential executables in Linux environments, crucial for system operations. Adversaries may move or copy these binaries to alternate locations to evade detection, often renaming them to blend in with legitimate processes. The detection rule identifies unusual movements or copies of these binaries, excluding common system processes and paths, to flag potential malicious activity. This helps in identifying attempts at masquerading, a tactic used to bypass security measures.
+
+
+*Possible investigation steps*
+
+
+- Review the file path and name in the alert to determine if the binary was moved or copied to a suspicious or unusual location, which could indicate an attempt to masquerade.
+- Examine the process name and executable path that triggered the alert to identify if it is associated with known legitimate processes or if it appears suspicious or unexpected.
+- Check the user account associated with the process to determine if the action was performed by a privileged or unauthorized user, which could suggest malicious intent.
+- Investigate the historical activity of the process and user involved to identify any patterns or previous suspicious behavior that might correlate with the current alert.
+- Correlate the alert with other security events or logs from the same timeframe to identify any related activities or anomalies that could provide additional context or evidence of malicious activity.
+
+
+*False positive analysis*
+
+
+- System updates and package installations often involve legitimate movement or copying of binaries. Exclude processes like dpkg, rpm, and apt-get from triggering alerts by adding them to the exception list.
+- Development and testing environments may frequently rename or move binaries for testing purposes. Consider excluding paths like /tmp or /dev/fd from monitoring if they are commonly used for non-malicious activities.
+- Automated scripts or configuration management tools such as Puppet or Chef may move binaries as part of their normal operations. Add these tools to the exception list to prevent unnecessary alerts.
+- Temporary files created during software installations or updates, such as those with extensions like .tmp or .dpkg-new, can trigger false positives. Exclude these extensions from monitoring to reduce noise.
+- Custom scripts or applications that mimic system processes for legitimate reasons might be flagged. Review and whitelist these specific scripts or applications if they are verified as non-threatening.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Terminate any suspicious processes identified in the alert that are associated with the unauthorized movement or copying of system binaries.
+- Restore any altered or moved system binaries to their original locations and verify their integrity using known good backups or checksums.
+- Conduct a thorough review of system logs and the alert details to identify any additional indicators of compromise or related malicious activity.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement additional monitoring on the affected system and similar environments to detect any recurrence of the activity, focusing on the specific paths and processes identified in the alert.
+- Review and update access controls and permissions to ensure that only authorized users and processes can modify or move system binaries, reducing the risk of similar incidents in the future.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "change" and event.action == "rename" and process.name != null and
+file.Ext.original.path : (
+  "/bin/*", "/usr/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*"
+) and not (
+  process.executable in (
+    "/bin/dpkg", "/usr/bin/dpkg", "/bin/dockerd", "/usr/bin/dockerd", "/usr/sbin/dockerd", "/bin/microdnf",
+    "/usr/bin/microdnf", "/bin/rpm", "/usr/bin/rpm", "/bin/snapd", "/usr/bin/snapd", "/bin/yum", "/usr/bin/yum",
+    "/bin/dnf", "/usr/bin/dnf", "/bin/podman", "/usr/bin/podman", "/bin/dnf-automatic", "/usr/bin/dnf-automatic",
+    "/bin/pacman", "/usr/bin/pacman", "/usr/bin/dpkg-divert", "/bin/dpkg-divert", "/sbin/apk", "/usr/sbin/apk",
+    "/usr/local/sbin/apk", "/usr/bin/apt", "/usr/sbin/pacman", "/bin/podman", "/usr/bin/podman", "/usr/bin/puppet",
+    "/bin/puppet", "/opt/puppetlabs/puppet/bin/puppet", "/usr/bin/chef-client", "/bin/chef-client",
+    "/bin/autossl_check", "/usr/bin/autossl_check", "/proc/self/exe", "/dev/fd/*",  "/usr/bin/pamac-daemon",
+    "/bin/pamac-daemon", "/usr/lib/snapd/snapd", "/usr/local/bin/dockerd", "/usr/libexec/netplan/generate",
+    "/usr/bin/update-alternatives", "/bin/update-alternatives", "/usr/sbin/update-alternatives",
+    "/sbin/update-alternatives", "/usr/bin/pip3", "/bin/pip3", "/usr/local/bin/pip3", "/usr/local/bin/node",
+    "/bin/node", "/usr/bin/node", "/sbin/apk", "/usr/sbin/apk", "/usr/local/sbin/apk", "/usr/bin/pip", "/bin/pip",
+    "/usr/local/bin/pip", "/usr/libexec/platform-python", "/usr/bin/platform-python", "/bin/platform-python",
+    "/usr/lib/systemd/systemd", "/usr/sbin/sshd", "/sbin/sshd", "/usr/local/sbin/sshd", "/usr/sbin/crond", "/sbin/crond",
+    "/usr/local/sbin/crond", "/usr/sbin/gdm"
+  ) or
+  process.name like (
+    "python*", "packagekitd", "systemd", "ln", "platform-python", "dnf_install", "runc", "apt-get", "ssm-agent-worker",
+    "convert-usrmerge", "updatenow.static-cpanelsync", "apk", "exe", "php", "containerd-shim-runc-v2", "dpkg", "sed",
+    "platform-python*", "gedit", "crond", "sshd", "ruby", "sudo", "chainctl", "update-alternatives", "pip*", "microdnf",
+    "rsync", "convert2rhel", "convert-usr-merge"
+  ) or
+  file.Ext.original.path : (
+    "/bin/*.tmp", "/usr/bin/*.tmp", "/usr/local/bin/*.tmp", "/sbin/*.tmp", "/usr/sbin/*.tmp", "/usr/local/sbin/*.tmp"
+  ) or
+  file.extension in ("swp", "swpx", "swx", "dpkg-remove") or
+  file.Ext.original.extension == "dpkg-new" or
+  process.executable : ("/nix/store/*", "/var/lib/dpkg/*", "/tmp/vmis.*", "/snap/*", "/dev/fd/*") or
+  process.executable == null or
+  (process.name == "sed" and file.name : "sed*") or
+  (process.name == "perl" and file.name : "e2scrub_all.tmp*")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename Legitimate Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location.asciidoc
new file mode 100644
index 0000000000..4d217cfb4d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location.asciidoc
@@ -0,0 +1,77 @@
+[[prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location]]
+=== System Binary Symlink to Suspicious Location
+
+This rule detects the creation of a symbolic link from a system binary to a suspicious and writable location. This activity may indicate an attacker's attempt to evade detection by behavioral rules that depend on predefined process parent/child relationships. By executing the symlinked variant of a binary instead of the original, the attacker aims to bypass these rules. Through the new_terms rule type, this rule can identify uncommon parent processes that may indicate the presence of a malicious symlink.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.parent.executable:* and
+(process.name:ln or process.name:busybox and process.args:ln or process.name:cp and process.args:--symbolic-link) and
+process.args:(
+  (
+    /bin/* or /lib/* or /lib64/* or /sbin/* or /usr/bin/* or /usr/lib/* or /usr/lib64/* or /usr/local/bin/* or
+    /usr/local/lib/* or /usr/local/lib64/* or /usr/local/sbin/* or /usr/sbin/*
+  ) and (
+    /*/.* or /dev/shm/* or /home/* or /root/* or /tmp/* or /var/tmp/*
+  ) and
+  not (/usr/bin/coreutils or /tmp/mkinitcpio* or /var/tmp/dracut* or /var/tmp/mkinitramfs*)
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-email-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-email-indicator-match.asciidoc
new file mode 100644
index 0000000000..fb3fe37d1b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-email-indicator-match.asciidoc
@@ -0,0 +1,127 @@
+[[prebuilt-rule-8-17-11-threat-intel-email-indicator-match]]
+=== Threat Intel Email Indicator Match
+
+This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Threat Intel Email Indicator Match Match*
+
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash, with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers.
+
+
+*Possible investigation steps*
+
+
+- Investigate the email indicator, which can be found in the threat.indicator.matched.atomic field:
+  - Determine the nature of the email-based threat (phishing, spam, BEC, malware attachment, etc.).
+  - Check the reputation of the email address, domain, and IP in threat intel platforms such as VirusTotal, AbuseIPDB, Cisco Talos, and others.
+  - Perform a WHOIS lookup on the sending domain to gather registration info and potential abuse contacts.
+  - Review historical context: Has this email indicator been observed in other events or associated with known campaigns?
+- If the event is potentially phishing or BEC-related:
+  - Contact the recipient to gather additional context (did they interact with the email, click links, open attachments, reply, etc.).
+  - Review the email headers and content to identify spoofing tactics, display name impersonation, or suspicious links/domains.
+  - Analyze the email body and any attachments for signs of malicious intent or social engineering techniques.
+  - Extract and investigate any embedded links, attachments, or payloads for further IOCs.
+- Check logs from email security gateways and mail servers for:
+  - Additional recipients or similar messages sent in the same timeframe.
+  - Delivery status and any filtering or quarantine actions taken.
+
+
+*False Positive Analysis*
+
+
+- False positives may occur when email indicators match legitimate communications.
+- Some threat intelligence feeds may mistakenly include benign or internal email addresses, domains, or sender infrastructure (e.g., noreply@yourdomain.com, legitimate SaaS providers, or shared mail services). Always validate indicators before taking enforcement actions.
+- Review the context of the match: Consider whether the sender domain or address is part of a known legitimate service, commonly used internally, or associated with a partner/vendor.
+- Blocking or alerting based on common email domains or infrastructure (e.g., mail gateways, newsletters, cloud-based platforms) without proper validation can lead to disruptions in communication.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If a user interacted with the malicious email (clicked a link, opened an attachment, replied, etc.), isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary email filters and segmentation to prevent further delivery or spread.
+  - Stop suspicious processes associated with any attachments or payloads.
+  - Immediately block the identified indicators of compromise (IoCs), including sender addresses, domains, URLs, and file hashes.
+  - Inspect affected systems for additional backdoors, such as reverse shells, droppers, or tunneling tools that could enable reinfection or remote access.
+- Consider reporting the sender address or domain for abuse using WHOIS or relevant abuse reporting services.
+- Remove and block malicious artifacts identified during triage, including phishing emails, attachments, and URLs.
+- Run a full antimalware scan. This may reveal additional artifacts, persistence mechanisms, or malware components on the system.
+- Determine the initial vector abused by the attacker—e.g., bypassed email filters, spoofed domain, etc.—and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+email.from.address:* or email.sender.address:* or email.reply_to.address:* or email.to.address:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-hash-indicator-match.asciidoc
new file mode 100644
index 0000000000..9dccdd7f81
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-hash-indicator-match.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-17-11-threat-intel-hash-indicator-match]]
+=== Threat Intel Hash Indicator Match
+
+This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+
+*Version*: 10
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Threat Intel Hash Indicator Match*
+
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.
+- Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:
+  - Search for the existence and reputation of the hash in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+  - Scope other potentially compromised hosts in your environment by mapping hosts with file operations involving the same hash.
+- Identify the process that created the file.
+  - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Enrich the information that you have right now by determining how the file was dropped, where it was downloaded from, etc. This can help you determine if the event is part of an ongoing campaign against the organization.
+- Retrieve the involved file and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+
+*False Positive Analysis*
+
+
+- Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file.hash.*:* or process.hash.*:* or dll.hash.*:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match.asciidoc
new file mode 100644
index 0000000000..0694b7f6f6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match.asciidoc
@@ -0,0 +1,140 @@
+[[prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match]]
+=== Threat Intel IP Address Indicator Match
+
+This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Threat Intel IP Address Indicator Match*
+
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.
+- Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+  - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+
+*False Positive Analysis*
+
+
+- When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.
+- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
+- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+source.ip:* or destination.ip:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-url-indicator-match.asciidoc
new file mode 100644
index 0000000000..479efe32d7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-url-indicator-match.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-17-11-threat-intel-url-indicator-match]]
+=== Threat Intel URL Indicator Match
+
+This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* packetbeat-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Threat Intel URL Indicator Match*
+
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:
+  - Identify the type of malicious activity related to the URL (phishing, malware, etc.).
+  - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+  - Execute a WHOIS lookup to retrieve information about the domain registration and contacts to report abuse.
+  - If dealing with a phishing incident:
+    - Contact the user to gain more information around the delivery method, information sent, etc.
+    - Analyze whether the URL is trying to impersonate a legitimate address. Look for typosquatting, extra or unusual subdomains, or other anomalies that could lure the user.
+    - Investigate the phishing page to identify which information may have been sent to the attacker by the user.
+- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+
+*False Positive Analysis*
+
+
+- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.
+- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Consider reporting the address for abuse using the provided contact information.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+url.full:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match.asciidoc
new file mode 100644
index 0000000000..1194ff66c0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match.asciidoc
@@ -0,0 +1,133 @@
+[[prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match]]
+=== Threat Intel Windows Registry Indicator Match
+
+This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data.
+
+*Rule type*: threat_match
+
+*Rule indices*: 
+
+* auditbeat-*
+* endgame-*
+* filebeat-*
+* logs-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 1h
+
+*Searches indices from*: now-65m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html
+* https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html
+* https://www.elastic.co/security/tip
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Rule Type: Threat Match
+* Resources: Investigation Guide
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Threat Intel Windows Registry Indicator Match*
+
+
+Threat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index.
+
+Matches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.
+
+This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Check related threat reports to gain context about the registry indicator of compromise (IoC) and to understand if it's a system-native mechanism abused for persistence, to store data, to disable security mechanisms, etc. Use this information to define the appropriate triage and respond steps.
+- Identify the process responsible for the registry operation and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.
+
+
+*False Positive Analysis*
+
+
+- Adversaries can leverage dual-use registry mechanisms that are commonly used by normal applications. These registry keys can be added into indicator lists creating the potential for false positives.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule needs threat intelligence indicators to work.
+Threat intelligence indicators can be collected using an https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration],
+the https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module],
+or a https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+
+More information can be found https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html[here].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry.path:*
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
new file mode 100644
index 0000000000..e4b7822d4b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -0,0 +1,169 @@
+[[prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading]]
+=== UAC Bypass Attempt via Windows Directory Masquerading
+
+Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 320
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating UAC Bypass Attempt via Windows Directory Masquerading*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze any suspicious spawned processes using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
new file mode 100644
index 0000000000..3f2ce53659
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
@@ -0,0 +1,119 @@
+[[prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent]]
+=== Unusual Execution from Kernel Thread (kthreadd) Parent
+
+This rule detects suspicious child process from the kernel thread (kthreadd) parent process. Attackers may execute payloads from kernel space via kthreadd to perform actions on the host and evade detection. Through the usage of the new_terms rule type, this rule can identify uncommon child processes that may indicate the presence of a malicious process.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.parent.name:kthreadd and (
+  process.executable:(/dev/shm/* or /tmp/* or /var/tmp/* or /var/www/*) or
+  process.name:(bash or csh or curl or dash or fish or id or ksh or nohup or setsid or sh or tcsh or wget or whoami or zsh)
+) and
+process.command_line:(
+  */dev/shm/* or */dev/tcp/* or */etc/init.d* or */etc/ld.so* or */etc/profile* or */etc/rc.local* or */etc/shadow* or */etc/ssh* or
+  */etc/sudoers* or */home/*/.ssh/* or */root/.ssh* or */tmp/* or */var/log/* or */var/run/* or */var/tmp/* or */var/www/* or
+  *base64* or *cron* or *xxd* or *~/.ssh/*
+) and not (
+  process.name:(true or cifs.upcall or dpkg or flock or gdbus or getopt or grep or mount or touch or umount or uname) or
+  process.command_line:(
+    "sh -c /bin/true" or */bin/ps* or */usr/bin/find* or */usr/bin/grep* or *ds_agent* or *gitlabrunner* or *nagios* or
+    *omsagent* or *pgrep*
+  ) or
+  process.executable:(
+    /lib/systemd/systemd-cgroups-agent or /proc/self/exe or /usr/local/axs-haproxy-monitoring/haproxy_stats.sh or /tmp/newroot/* or
+    /var/lib/docker/overlay2/* or /vz/root/*
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-exim4-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-exim4-child-process.asciidoc
new file mode 100644
index 0000000000..765831845f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-exim4-child-process.asciidoc
@@ -0,0 +1,70 @@
+[[prebuilt-rule-8-17-11-unusual-exim4-child-process]]
+=== Unusual Exim4 Child Process
+
+This rule detects the execution of unusual commands via a descendant process of exim4. Attackers may use descendant processes of exim4 to evade detection and establish persistence or execute post-exploitation commands on a target system.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.qualys.com/2021/05/04/21nails/21nails.txt
+* https://blog.qualys.com/vulnerabilities-threat-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.type:start and event.action:exec and process.parent.name:exim4 and
+not process.name:(
+  exim4 or start-stop-daemon or run-parts or systemctl or update-exim4.conf or install or plymouth or
+  readlink or grep or stat or cmake or gcc or cppcheck or sort or sshd
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
+* Technique:
+** Name: Compromise Host Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
new file mode 100644
index 0000000000..d5c26a86bf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
@@ -0,0 +1,132 @@
+[[prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments]]
+=== Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments
+
+This rule detects the use of the LD_PRELOAD and LD_LIBRARY_PATH environment variables in a command line argument. This behavior is unusual and may indicate an attempt to hijack the execution flow of a process. Threat actors may use this technique to evade defenses, escalate privileges, or maintain persistence on a system.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and
+process.parent.name:(* and not (
+  awk or bwrap or cylancesvc or dbus-run-session or java or julia or make or matlab_helper or ninja or noproc_sandbox or
+  nxrunner or nxserver or perl or rear or sapcontrol or setsid or spoold or sshd or steam or su or sudo or titanagent or
+  vls_agent or zabbix_agentd
+)) and
+process.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
+process.args:-c and process.command_line:(*LD_LIBRARY_PATH=* or *LD_PRELOAD=*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary.asciidoc
new file mode 100644
index 0000000000..34c4d2e7ee
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -0,0 +1,214 @@
+[[prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary]]
+=== Unusual Network Activity from a Windows System Binary
+
+Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-endpoint.events.network-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Network Activity from a Windows System Binary*
+
+
+Attackers can abuse certain trusted developer utilities to proxy the execution of malicious payloads. Since these utilities are usually signed, they can bypass the security controls that were put in place to prevent or detect direct execution.
+
+This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- As trusted developer utilities have dual-use purposes, alerts derived from this rule are not essentially malicious. If these utilities are contacting internal or known trusted domains, review their security and consider creating exceptions if the domain is safe.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=5m
+  [process where host.os.type == "windows" and event.type == "start" and
+
+     /* known applocker bypasses */
+     (process.name : "bginfo.exe" or
+      process.name : "cdb.exe" or
+      process.name : "control.exe" or
+      process.name : "cmstp.exe" or
+      process.name : "csi.exe" or
+      process.name : "dnx.exe" or
+      process.name : "fsi.exe" or
+      process.name : "ieexec.exe" or
+      process.name : "iexpress.exe" or
+      process.name : "installutil.exe" or
+      process.name : "Microsoft.Workflow.Compiler.exe" or
+      process.name : "MSBuild.exe" or
+      process.name : "msdt.exe" or
+      process.name : "mshta.exe" or
+      process.name : "wscript.exe" or
+      process.name : "msiexec.exe" or
+      process.name : "msxsl.exe" or
+      process.name : "odbcconf.exe" or
+      process.name : "rcsi.exe" or
+      process.name : "regsvr32.exe" or
+      process.name : "xwizard.exe")]
+  [network where
+     (process.name : "bginfo.exe" or
+      process.name : "cdb.exe" or
+      process.name : "control.exe" or
+      process.name : "cmstp.exe" or
+      process.name : "csi.exe" or
+      process.name : "dnx.exe" or
+      process.name : "fsi.exe" or
+      process.name : "ieexec.exe" or
+      process.name : "iexpress.exe" or
+      process.name : "installutil.exe" or
+      process.name : "Microsoft.Workflow.Compiler.exe" or
+      (
+        process.name : "msbuild.exe" and
+          destination.ip != "127.0.0.1"
+      ) or
+      process.name : "msdt.exe" or
+      process.name : "mshta.exe" or
+      (
+        process.name : "msiexec.exe" and not
+        dns.question.name : (
+           "ocsp.digicert.com", "ocsp.verisign.com", "ocsp.comodoca.com", "ocsp.entrust.net", "ocsp.usertrust.com",
+           "ocsp.godaddy.com", "ocsp.camerfirma.com", "ocsp.globalsign.com", "ocsp.sectigo.com", "*.local"
+        ) and
+        /* Localhost, DigiCert and Comodo CA IP addresses */
+        not cidrmatch(destination.ip, "127.0.0.1", "192.229.211.108/32", "192.229.221.95/32",
+                      "152.195.38.76/32", "104.18.14.101/32")
+      ) or
+      process.name : "msxsl.exe" or
+      process.name : "odbcconf.exe" or
+      process.name : "rcsi.exe" or
+      process.name : "regsvr32.exe" or
+      process.name : "xwizard.exe") and 
+      
+      not dns.question.name : ("localhost", "setup.officetimeline.com", "us.deployment.endpoint.ingress.rapid7.com", 
+        "ctldl.windowsupdate.com", "crl?.digicert.com", "ocsp.digicert.com", "addon-cms-asl.eu.goskope.com", "crls.ssl.com", 
+        "evcs-ocsp.ws.symantec.com", "s.symcd.com", "s?.symcb.com", "crl.verisign.com", "oneocsp.microsoft.com", "crl.verisign.com", 
+        "aka.ms", "crl.comodoca.com", "acroipm2.adobe.com", "sv.symcd.com") and 
+
+      /* host query itself */
+      not startswith~(dns.question.name, host.name)
+      ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Resource Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Sub-technique:
+** Name: Mshta
+** ID: T1218.005
+** Reference URL: https://attack.mitre.org/techniques/T1218/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet.asciidoc
new file mode 100644
index 0000000000..533ee6bb0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet]]
+=== VNC (Virtual Network Computing) from the Internet
+
+This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+* logs-panw.panos*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Data Source: PAN-OS
+* Resources: Investigation Guide
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating VNC (Virtual Network Computing) from the Internet*
+
+
+VNC allows remote control of systems, facilitating maintenance and resource sharing. However, when exposed to the Internet, it becomes a target for attackers seeking unauthorized access. Adversaries exploit VNC for initial access or as a backdoor. The detection rule identifies suspicious VNC traffic by monitoring specific TCP ports and filtering out trusted IP ranges, flagging potential threats for further investigation.
+
+
+*Possible investigation steps*
+
+
+- Review the source IP address of the alert to determine if it is from an untrusted or suspicious location, as the rule filters out known trusted IP ranges.
+- Check the destination IP address to confirm it belongs to an internal network (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) and verify if the system is authorized to receive VNC traffic.
+- Analyze the network traffic logs for the specified TCP ports (5800-5810) to identify any unusual patterns or repeated access attempts that could indicate malicious activity.
+- Investigate the context of the event by correlating it with other security alerts or logs to determine if there are signs of a broader attack or compromise.
+- Assess the risk and impact of the potential threat by evaluating the criticality of the affected system and any sensitive data it may contain.
+
+
+*False positive analysis*
+
+
+- Internal testing or maintenance activities may trigger the rule if VNC is used for legitimate purposes within a controlled environment. To manage this, create exceptions for known internal IP addresses that frequently use VNC for authorized tasks.
+- Automated systems or scripts that utilize VNC for routine operations might be flagged. Identify these systems and exclude their IP addresses from the rule to prevent unnecessary alerts.
+- Remote workers using VPNs that route traffic through public IPs could be mistakenly identified as threats. Ensure that VPN IP ranges are included in the trusted IP list to avoid false positives.
+- Misconfigured network devices that inadvertently expose VNC ports to the Internet can cause alerts. Regularly audit network configurations to ensure VNC ports are not exposed and adjust the rule to exclude known safe configurations.
+- Third-party service providers accessing systems via VNC for support purposes might be flagged. Establish a list of trusted IPs for these providers and update the rule to exclude them from detection.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
+- Terminate any active VNC sessions originating from untrusted IP addresses to cut off potential attacker access.
+- Conduct a thorough review of system logs and network traffic to identify any unauthorized changes or data access that may have occurred during the VNC session.
+- Reset credentials for any accounts that were accessed or could have been compromised during the unauthorized VNC session.
+- Apply security patches and updates to the VNC software and any other potentially vulnerable applications on the affected system.
+- Implement network segmentation to ensure that VNC services are only accessible from trusted internal networks and not exposed to the Internet.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems may be affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet.asciidoc
new file mode 100644
index 0000000000..45863ba2ad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet]]
+=== VNC (Virtual Network Computing) to the Internet
+
+This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+* logs-panw.panos*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Data Source: PAN-OS
+* Resources: Investigation Guide
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating VNC (Virtual Network Computing) to the Internet*
+
+
+VNC is a tool that allows remote control of computers, often used by administrators for maintenance. However, when exposed to the internet, it becomes a target for attackers seeking unauthorized access. Adversaries exploit VNC to establish backdoors or gain initial access. The detection rule identifies suspicious VNC traffic by monitoring specific TCP ports and filtering out internal IP addresses, flagging potential threats when VNC is accessed from external networks.
+
+
+*Possible investigation steps*
+
+
+- Review the source IP address to determine if it belongs to a known internal asset or user, and verify if the access was authorized.
+- Check the destination IP address to confirm if it is an external address and investigate its reputation or any known associations with malicious activity.
+- Analyze the network traffic logs for the specified TCP ports (5800-5810) to identify any unusual patterns or volumes of VNC traffic.
+- Correlate the VNC traffic event with other security events or logs to identify any related suspicious activities or anomalies.
+- Investigate the user account associated with the VNC session to ensure it has not been compromised or misused.
+- Assess the system or application logs on the destination machine for any signs of unauthorized access or changes during the time of the VNC connection.
+
+
+*False positive analysis*
+
+
+- Internal maintenance activities may trigger the rule if VNC is used for legitimate remote administration. To manage this, create exceptions for known internal IP addresses that frequently use VNC for maintenance.
+- Automated scripts or tools that use VNC for legitimate purposes might be flagged. Identify these tools and whitelist their IP addresses to prevent unnecessary alerts.
+- Testing environments that simulate external access to VNC for security assessments can cause false positives. Exclude IP ranges associated with these environments to avoid confusion.
+- Cloud-based services that use VNC for remote management might be misidentified as threats. Verify these services and add their IP addresses to an exception list if they are trusted.
+- Temporary remote access setups for troubleshooting or support can be mistaken for unauthorized access. Document these instances and apply temporary exceptions to reduce false alerts.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
+- Terminate any active VNC sessions that are identified as originating from external networks to cut off potential attacker access.
+- Conduct a thorough review of system logs and network traffic to identify any unauthorized access or data transfer that may have occurred during the VNC exposure.
+- Change all passwords and credentials associated with the affected system and any other systems that may have been accessed using the same credentials.
+- Apply necessary patches and updates to the VNC software and any other vulnerable applications on the affected system to mitigate known vulnerabilities.
+- Implement network segmentation to ensure that VNC services are only accessible from trusted internal networks and not exposed to the internet.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems may be compromised.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow  or (event.category: (network or network_traffic))) and
+  network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Tools
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration.asciidoc
new file mode 100644
index 0000000000..a68e5da10b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration]]
+=== Windows Sandbox with Sensitive Configuration
+
+Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write access to the host file system, network connection and automatic execution via logon command. Malware may abuse the sandbox feature to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog-en.itochuci.co.jp/entry/2025/03/12/140000
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wsb.exe", "WindowsSandboxClient.exe") and
+  process.command_line : ("*<Networking>Enable</Networking>*",
+                          "*<HostFolder>C:\\*<ReadOnly>false*",
+                          "*<LogonCommand>*",
+                          "*<NetworkingEnabled>true*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Run Virtual Instance
+** ID: T1564.006
+** Reference URL: https://attack.mitre.org/techniques/T1564/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-appendix.asciidoc
new file mode 100644
index 0000000000..fcbd7be9f3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-appendix.asciidoc
@@ -0,0 +1,86 @@
+["appendix",role="exclude",id="prebuilt-rule-8-17-11-prebuilt-rules-8-17-11-appendix"]
+= Downloadable rule update v8.17.11
+
+This section lists all updates associated with version 8.17.11 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc[]
+include::prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc[]
+include::prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc[]
+include::prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc[]
+include::prebuilt-rule-8-17-11-linux-telegram-api-request.asciidoc[]
+include::prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line.asciidoc[]
+include::prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-path-mounted.asciidoc[]
+include::prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-kernel-feature-activity.asciidoc[]
+include::prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-named-pipe-creation.asciidoc[]
+include::prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec.asciidoc[]
+include::prebuilt-rule-8-17-11-unusual-exim4-child-process.asciidoc[]
+include::prebuilt-rule-8-17-11-docker-release-file-creation.asciidoc[]
+include::prebuilt-rule-8-17-11-rare-connection-to-webdav-target.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc[]
+include::prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse.asciidoc[]
+include::prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration.asciidoc[]
+include::prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created.asciidoc[]
+include::prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc[]
+include::prebuilt-rule-8-17-11-system-binary-moved-or-copied.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-proc-maps-discovery.asciidoc[]
+include::prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate.asciidoc[]
+include::prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet.asciidoc[]
+include::prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet.asciidoc[]
+include::prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match.asciidoc[]
+include::prebuilt-rule-8-17-11-threat-intel-email-indicator-match.asciidoc[]
+include::prebuilt-rule-8-17-11-threat-intel-hash-indicator-match.asciidoc[]
+include::prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match.asciidoc[]
+include::prebuilt-rule-8-17-11-threat-intel-url-indicator-match.asciidoc[]
+include::prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation.asciidoc[]
+include::prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services.asciidoc[]
+include::prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process.asciidoc[]
+include::prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer.asciidoc[]
+include::prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-communication-app-child-process.asciidoc[]
+include::prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name.asciidoc[]
+include::prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps.asciidoc[]
+include::prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter.asciidoc[]
+include::prebuilt-rule-8-17-11-program-files-directory-masquerading.asciidoc[]
+include::prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading.asciidoc[]
+include::prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary.asciidoc[]
+include::prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name.asciidoc[]
+include::prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable.asciidoc[]
+include::prebuilt-rule-8-17-11-browser-extension-install.asciidoc[]
+include::prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc[]
+include::prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-summary.asciidoc
new file mode 100644
index 0000000000..b3ab9d8d11
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-summary.asciidoc
@@ -0,0 +1,172 @@
+[[prebuilt-rule-8-17-11-prebuilt-rules-8-17-11-summary]]
+[role="xpack"]
+== Update v8.17.11
+
+This section lists all updates associated with version 8.17.11 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-17-11-microsoft-azure-or-mail-sign-in-from-a-suspicious-source, Microsoft Azure or Mail Sign-in from a Suspicious Source>> | This rule correlate Azure or Office 356 mail successful sign-in events with network security alerts by source.ip. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources. | new | 1 
+
+|<<prebuilt-rule-8-17-11-aws-s3-static-site-javascript-file-uploaded, AWS S3 Static Site JavaScript File Uploaded>> | This rule detects when a JavaScript file is uploaded or accessed in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker, Microsoft Entra ID SharePoint Access for User Principal via Auth Broker>> | This rule detects non-interactive authentication activity against SharePoint Online (`Office 365 SharePoint Online`) by a user principal via the `Microsoft Authentication Broker` application. The session leverages a refresh token or Primary Refresh Token (PRT) without interactive sign-in, often used in OAuth phishing or token replay scenarios. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-entra-id-protection-anonymized-ip-risk-detection, Microsoft Entra ID Protection Anonymized IP Risk Detection>> | Identifies Microsoft Entra ID Protection risk detections triggered due to sign-in activity from anonymized IP addresses, which is often associated with Tor exit nodes, proxies, or anonymizing VPNs. This behavior may indicate evasion tactics or account compromise activity. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties, Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties>> | Identifies concurrent azure signin events for the same user and from multiple sources, and where one of the authentication event has some suspicious properties often associated to DeviceCode and OAuth phishing. Adversaries may steal Refresh Tokens (RTs) via phishing to bypass multi-factor authentication (MFA) and gain unauthorized access to Azure resources. | new | 1 
+
+|<<prebuilt-rule-8-17-11-suspicious-activity-via-auth-broker-on-behalf-of-principal-user, Suspicious Activity via Auth Broker On-Behalf-of Principal User>> | Identifies suspicious activity from the Microsoft Authentication Broker in Microsoft Entra ID sign-in logs. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to register a device and access Microsoft services as a user. The pattern includes sign-ins from multiple IPs across services (Microsoft Graph, DRS, AAD) using the Authentication Broker client on behalf of a principal user. | new | 1 
+
+|<<prebuilt-rule-8-17-11-multiple-microsoft-entra-id-protection-alerts-by-user-principal, Multiple Microsoft Entra ID Protection Alerts by User Principal>> | Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-graph-first-occurrence-of-client-request, Microsoft Graph First Occurrence of Client Request>> | This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-365-oauth-redirect-to-device-registration-for-user-principal, Microsoft 365 OAuth Redirect to Device Registration for User Principal>> | Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources. | new | 1 
+
+|<<prebuilt-rule-8-17-11-suspicious-microsoft-365-userloggedin-via-oauth-code, Suspicious Microsoft 365 UserLoggedIn via OAuth Code>> | Identifies sign-ins on behalf of a principal user to the Microsoft Graph API from multiple IPs using the Microsoft Authentication Broker or Visual Studio Code application. This behavior may indicate an adversary using a phished OAuth refresh token. | new | 1 
+
+|<<prebuilt-rule-8-17-11-microsoft-365-oauth-phishing-via-visual-studio-code-client, Microsoft 365 OAuth Phishing via Visual Studio Code Client>> | Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. | new | 1 
+
+|<<prebuilt-rule-8-17-11-git-repository-or-file-download-to-suspicious-directory, Git Repository or File Download to Suspicious Directory>> | This rule detects the use of git to clone a repository or download files from GitHub using wget or curl, followed by the creation of files in suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior may indicate an attempt to download a payload, exploit or tool. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-linux-tunneling-and-or-port-forwarding-via-ssh-option, Potential Linux Tunneling and/or Port Forwarding via SSH Option>> | This rule detects the use of SSH options that may indicate tunneling or port forwarding on Linux systems. This behavior is commonly associated with malicious activity, such as establishing a port forward, proxy or an encrypted tunnel to exfiltrate data. | new | 1 
+
+|<<prebuilt-rule-8-17-11-linux-telegram-api-request, Linux Telegram API Request>> | This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior. | new | 1 
+
+|<<prebuilt-rule-8-17-11-manual-memory-dumping-via-proc-filesystem, Manual Memory Dumping via Proc Filesystem>> | This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-hex-payload-execution-via-command-line, Potential Hex Payload Execution via Command-Line>> | This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use hexadecimal encoding to obfuscate their payload and evade detection. | new | 1 
+
+|<<prebuilt-rule-8-17-11-unusual-ld-preload-ld-library-path-command-line-arguments, Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments>> | This rule detects the use of the LD_PRELOAD and LD_LIBRARY_PATH environment variables in a command line argument. This behavior is unusual and may indicate an attempt to hijack the execution flow of a process. Threat actors may use this technique to evade defenses, escalate privileges, or maintain persistence on a system. | new | 1 
+
+|<<prebuilt-rule-8-17-11-suspicious-path-mounted, Suspicious Path Mounted>> | This rule detects suspicious paths mounted on Linux systems. The mount command is used to attach filesystems to the system, and attackers may use it to mount malicious filesystems or directories for data exfiltration or persistence. | new | 1 
+
+|<<prebuilt-rule-8-17-11-system-binary-symlink-to-suspicious-location, System Binary Symlink to Suspicious Location>> | This rule detects the creation of a symbolic link from a system binary to a suspicious and writable location. This activity may indicate an attacker's attempt to evade detection by behavioral rules that depend on predefined process parent/child relationships. By executing the symlinked variant of a binary instead of the original, the attacker aims to bypass these rules. Through the new_terms rule type, this rule can identify uncommon parent processes that may indicate the presence of a malicious symlink. | new | 1 
+
+|<<prebuilt-rule-8-17-11-suspicious-kernel-feature-activity, Suspicious Kernel Feature Activity>> | This rule detects the modification and reading of kernel features through built-in commands. Attackers may collect information, disable or weaken Linux kernel protections. For example, an attacker may modify ASLR protection by disabling kernel.randomize_va_space, allow ptrace by setting kernel.yama.ptrace_scope to 0, or disable the NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to impair defenses and evade detection. | new | 1 
+
+|<<prebuilt-rule-8-17-11-manual-mount-discovery-via-etc-exports-or-etc-fstab, Manual Mount Discovery via /etc/exports or /etc/fstab>> | This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this file to gather information about shared directories and potential targets for further exploitation. | new | 1 
+
+|<<prebuilt-rule-8-17-11-suspicious-named-pipe-creation, Suspicious Named Pipe Creation>> | This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe. | new | 1 
+
+|<<prebuilt-rule-8-17-11-unusual-execution-from-kernel-thread-kthreadd-parent, Unusual Execution from Kernel Thread (kthreadd) Parent>> | This rule detects suspicious child process from the kernel thread (kthreadd) parent process. Attackers may execute payloads from kernel space via kthreadd to perform actions on the host and evade detection. Through the usage of the new_terms rule type, this rule can identify uncommon child processes that may indicate the presence of a malicious process. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-data-exfiltration-through-curl, Potential Data Exfiltration Through Curl>> | Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-backdoor-execution-through-pam-exec, Potential Backdoor Execution Through PAM_EXEC>> | This rule detects SSH session ID change followed by a suspicious SSHD child process, this may indicate the successful execution of a potentially malicious process through the Pluggable Authentication Module (PAM) utility. PAM is a framework used by Linux systems to authenticate users. Adversaries may create malicious PAM modules that grant them persistence onto the target every time a user logs in by executing a backdoor script or command. | new | 1 
+
+|<<prebuilt-rule-8-17-11-unusual-exim4-child-process, Unusual Exim4 Child Process>> | This rule detects the execution of unusual commands via a descendant process of exim4. Attackers may use descendant processes of exim4 to evade detection and establish persistence or execute post-exploitation commands on a target system. | new | 1 
+
+|<<prebuilt-rule-8-17-11-docker-release-file-creation, Docker Release File Creation>> | This rule detects the creation of files named release_agent or notify_on_release, which are commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host from within a container. | new | 1 
+
+|<<prebuilt-rule-8-17-11-rare-connection-to-webdav-target, Rare Connection to WebDAV Target>> | Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-invalid-escape-sequences, Potential PowerShell Obfuscation via Invalid Escape Sequences>> | Identifies PowerShell scripts that use invalid escape sequences as a form of obfuscation. This technique introduces backticks (`) between characters in a way that does not correspond to valid PowerShell escape sequences, breaking up strings and bypassing pattern-based detections while preserving execution logic. This is designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-backtick-escaped-variable-expansion, Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion>> | Identifies PowerShell scripts that use backtick-escaped characters inside ${} variable expansion as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-character-array-reconstruction, Potential PowerShell Obfuscation via Character Array Reconstruction>> | Identifies PowerShell scripts that use character arrays and runtime string reconstruction as a form of obfuscation. This technique breaks strings into individual characters, often using constructs like char[] with index-based access or joining logic. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation, Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation>> | Identifies PowerShell scripts that use concatenated strings within dynamic command invocation (&() or .()) as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-high-numeric-character-proportion, Potential PowerShell Obfuscation via High Numeric Character Proportion>> | Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code manipulation, or embedded encoded strings used to deliver and execute malicious content. | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-dynamic-iex-reconstruction-via-environment-variables, Potential Dynamic IEX Reconstruction via Environment Variables>> | Identifies PowerShell scripts that reconstruct the IEX (Invoke-Expression) command at runtime using indexed slices of environment variables. This technique leverages character access and join operations to build execution logic dynamically, bypassing static keyword detection and evading defenses such as AMSI. | new | 1 
+
+|<<prebuilt-rule-8-17-11-powershell-obfuscation-via-negative-index-string-reversal, PowerShell Obfuscation via Negative Index String Reversal>> | Identifies PowerShell scripts that use negative index ranges to reverse the contents of a string or array at runtime as a form of obfuscation. This technique avoids direct use of reversal functions by iterating through array elements in reverse order. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-reverse-keywords, Potential PowerShell Obfuscation via Reverse Keywords>> | Identifies PowerShell scripts that use reversed strings as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-string-concatenation, Potential PowerShell Obfuscation via String Concatenation>> | Identifies PowerShell scripts that use string concatenation as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). | new | 1 
+
+|<<prebuilt-rule-8-17-11-potential-powershell-obfuscation-via-special-character-overuse, Potential PowerShell Obfuscation via Special Character Overuse>> | Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative of obfuscation. This behavior is commonly associated with techniques such as SecureString encoding, formatting obfuscation, or character-level manipulation designed to bypass static analysis and AMSI inspection. | new | 1 
+
+|<<prebuilt-rule-8-17-11-windows-sandbox-with-sensitive-configuration, Windows Sandbox with Sensitive Configuration>> | Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write access to the host file system, network connection and automatic execution via logon command. Malware may abuse the sandbox feature to evade detection. | new | 1 
+
+|<<prebuilt-rule-8-17-11-azure-entra-sign-in-brute-force-against-microsoft-365-accounts, Azure Entra Sign-in Brute Force against Microsoft 365 Accounts>> | Identifies potential brute-force attempts against Microsoft 365 user accounts by detecting a high number of failed interactive or non-interactive login attempts within a 30-minute window. Attackers may attempt to brute force user accounts to gain unauthorized access to Microsoft 365 services via different services such as Exchange, SharePoint, or Teams. | update | 4 
+
+|<<prebuilt-rule-8-17-11-microsoft-entra-id-oauth-phishing-via-visual-studio-code-client, Microsoft Entra ID OAuth Phishing via Visual Studio Code Client>> | Detects potentially suspicious OAuth authorization activity in Microsoft Entra ID where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode's Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. | update | 3 
+
+|<<prebuilt-rule-8-17-11-microsoft-entra-id-service-principal-created, Microsoft Entra ID Service Principal Created>> | Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. | update | 108 
+
+|<<prebuilt-rule-8-17-11-machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain, Machine Learning Detected DGA activity using a known SUNBURST DNS domain>> | A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm. | update | 9 
+
+|<<prebuilt-rule-8-17-11-system-binary-moved-or-copied, System Binary Moved or Copied>> | This rule monitors for the copying or moving of a system binary. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. | update | 17 
+
+|<<prebuilt-rule-8-17-11-potential-hex-payload-execution-via-common-utility, Potential Hex Payload Execution via Common Utility>> | This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms. | update | 105 
+
+|<<prebuilt-rule-8-17-11-potential-process-name-stomping-with-prctl, Potential Process Name Stomping with Prctl>> | This rule leverages Auditd data to detect the use of the `prctl` syscall to potentially hide a process by changing its name. The `prctl` syscall is used to control various process attributes. Attackers can use this syscall to change the name of a process to a hidden directory or file, making it harder to detect. The query looks for the `prctl` syscall with the `PR_SET_NAME` argument set to `f` (PR_SET_NAME is used to set the name of a process). | update | 5 
+
+|<<prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-files, Suspicious Renaming of ESXI Files>> | Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity. | update | 11 
+
+|<<prebuilt-rule-8-17-11-suspicious-renaming-of-esxi-index-html-file, Suspicious Renaming of ESXI index.html File>> | Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity. | update | 11 
+
+|<<prebuilt-rule-8-17-11-suspicious-proc-maps-discovery, Suspicious /proc/maps Discovery>> | Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking. | update | 7 
+
+|<<prebuilt-rule-8-17-11-default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> | This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. | update | 108 
+
+|<<prebuilt-rule-8-17-11-vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> | This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 109 
+
+|<<prebuilt-rule-8-17-11-vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> | This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 109 
+
+|<<prebuilt-rule-8-17-11-threat-intel-ip-address-indicator-match, Threat Intel IP Address Indicator Match>> | This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event. | update | 9 
+
+|<<prebuilt-rule-8-17-11-threat-intel-email-indicator-match, Threat Intel Email Indicator Match>> | This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers. | update | 2 
+
+|<<prebuilt-rule-8-17-11-threat-intel-hash-indicator-match, Threat Intel Hash Indicator Match>> | This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events. | update | 10 
+
+|<<prebuilt-rule-8-17-11-threat-intel-windows-registry-indicator-match, Threat Intel Windows Registry Indicator Match>> | This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data. | update | 9 
+
+|<<prebuilt-rule-8-17-11-threat-intel-url-indicator-match, Threat Intel URL Indicator Match>> | This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc. | update | 9 
+
+|<<prebuilt-rule-8-17-11-rapid7-threat-command-cves-correlation, Rapid7 Threat Command CVEs Correlation>> | This rule is triggered when CVEs collected from the Rapid7 Threat Command Integration have a match against vulnerabilities that were found in the customer environment. | update | 107 
+
+|<<prebuilt-rule-8-17-11-connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> | Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. | update | 120 
+
+|<<prebuilt-rule-8-17-11-first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> | Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. | update | 112 
+
+|<<prebuilt-rule-8-17-11-suspicious-screenconnect-client-child-process, Suspicious ScreenConnect Client Child Process>> | Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software. | update | 312 
+
+|<<prebuilt-rule-8-17-11-remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> | Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. | update | 216 
+
+|<<prebuilt-rule-8-17-11-attempt-to-establish-vscode-remote-tunnel, Attempt to Establish VScode Remote Tunnel>> | Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance. | update | 109 
+
+|<<prebuilt-rule-8-17-11-suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> | Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. | update | 318 
+
+|<<prebuilt-rule-8-17-11-suspicious-communication-app-child-process, Suspicious Communication App Child Process>> | Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. | update | 10 
+
+|<<prebuilt-rule-8-17-11-microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> | An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. | update | 217 
+
+|<<prebuilt-rule-8-17-11-process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> | Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. | update | 318 
+
+|<<prebuilt-rule-8-17-11-suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> | A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. | update | 318 
+
+|<<prebuilt-rule-8-17-11-potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> | Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. | update | 8 
+
+|<<prebuilt-rule-8-17-11-potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> | Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. | update | 10 
+
+|<<prebuilt-rule-8-17-11-renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> | Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. | update | 215 
+
+|<<prebuilt-rule-8-17-11-program-files-directory-masquerading, Program Files Directory Masquerading>> | Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. | update | 317 
+
+|<<prebuilt-rule-8-17-11-potential-windows-error-manager-masquerading, Potential Windows Error Manager Masquerading>> | Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections. | update | 213 
+
+|<<prebuilt-rule-8-17-11-unusual-network-activity-from-a-windows-system-binary, Unusual Network Activity from a Windows System Binary>> | Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. | update | 217 
+
+|<<prebuilt-rule-8-17-11-renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> | Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. | update | 214 
+
+|<<prebuilt-rule-8-17-11-execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> | Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. | update | 319 
+
+|<<prebuilt-rule-8-17-11-suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> | Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. | update | 215 
+
+|<<prebuilt-rule-8-17-11-browser-extension-install, Browser Extension Install>> | Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system. | update | 206 
+
+|<<prebuilt-rule-8-17-11-suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> | Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. | update | 217 
+
+|<<prebuilt-rule-8-17-11-uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> | Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. | update | 320 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 55b7a54b27..d69d6972e4 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
+|<<prebuilt-rule-8-17-11-prebuilt-rules-8-17-11-summary, 8.17.11>> | 07 May 2025 | 39 | 41 | 
+This release includes new rules for Windows, Linux, Azure, AWS and Microsoft 365. New rules for Windows include detection for defense evasion and credential access. New rules for Linux include detection for command and control, defense evasion, exfiltration, discovery, persistence, execution, privilege escalation and credential access. New rules for Azure include detection for initial access, credential access, collection, defense evasion and command and control. New rules for AWS include detection for impact. New rules for Microsoft 365 include defense evasion, initial access and credential access. Additionally, significant rule tuning for Windows, Linux and Azure rules has been added for better rule efficacy and performance.
+
+
 |<<prebuilt-rule-8-17-10-prebuilt-rules-8-17-10-summary, 8.17.10>> | 30 Apr 2025 | 0 | 55 | 
 Version parity to ensure future updates are more meaningful and informative
 
@@ -65,3 +69,4 @@ include::downloadable-packages/8-17-7/prebuilt-rules-8-17-7-summary.asciidoc[lev
 include::downloadable-packages/8-17-8/prebuilt-rules-8-17-8-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-17-9/prebuilt-rules-8-17-9-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-17-10/prebuilt-rules-8-17-10-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-17-11/prebuilt-rules-8-17-11-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 7036507500..1da71b1de0 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -212,6 +212,8 @@ and their rule type is `machine_learning`.
 
 |<<aws-s3-object-versioning-suspended, AWS S3 Object Versioning Suspended>> |Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS S3], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide] |None |5
 
+|<<aws-s3-static-site-javascript-file-uploaded, AWS S3 Static Site JavaScript File Uploaded>> |This rule detects when a JavaScript file is uploaded or accessed in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS S3], [Tactic: Impact], [Use Case: Web Application Compromise], [Use Case: Cloud Threat Detection], [Resources: Investigation Guide] |None |1
+
 |<<aws-s3-unauthenticated-bucket-access-by-rare-source, AWS S3 Unauthenticated Bucket Access by Rare Source>> |Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify `--no-sign-request` in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule, which means it will only trigger once for each unique value of the `source.address` field that has not been seen making this API request within the last 7 days. This field contains the IP address of the source making the request. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: Amazon S3], [Use Case: Asset Visibility], [Resources: Investigation Guide], [Tactic: Collection] |None |4
 
 |<<aws-sns-email-subscription-by-rare-user, AWS SNS Email Subscription by Rare User>> |Identifies when an SNS topic is subscribed to by an email address of a user who does not typically perform this action. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |5
@@ -352,7 +354,7 @@ and their rule type is `machine_learning`.
 
 |<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |110
 
-|<<attempt-to-establish-vscode-remote-tunnel, Attempt to Establish VScode Remote Tunnel>> |Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |108
+|<<attempt-to-establish-vscode-remote-tunnel, Attempt to Establish VScode Remote Tunnel>> |Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |109
 
 |<<attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> |Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |213
 
@@ -422,7 +424,7 @@ and their rule type is `machine_learning`.
 
 |<<azure-entra-sign-in-brute-force-microsoft-365-accounts-by-repeat-source, Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source>> |Identifies potential brute-force attempts against Microsoft 365 user accounts by detecting a high number of failed interactive or non-interactive login attempts within a 30-minute window from a single source. Attackers may attempt to brute force user accounts to gain unauthorized access to Microsoft 365 services via different services such as Exchange, SharePoint, or Teams. |[Domain: Cloud], [Domain: SaaS], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |3
 
-|<<azure-entra-sign-in-brute-force-against-microsoft-365-accounts, Azure Entra Sign-in Brute Force against Microsoft 365 Accounts>> |Identifies potential brute-force attempts against Microsoft 365 user accounts by detecting a high number of failed interactive or non-interactive login attempts within a 30-minute window. Attackers may attempt to brute force user accounts to gain unauthorized access to Microsoft 365 services via different services such as Exchange, SharePoint, or Teams. |[Domain: Cloud], [Domain: SaaS], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |3
+|<<azure-entra-sign-in-brute-force-against-microsoft-365-accounts, Azure Entra Sign-in Brute Force against Microsoft 365 Accounts>> |Identifies potential brute-force attempts against Microsoft 365 user accounts by detecting a high number of failed interactive or non-interactive login attempts within a 30-minute window. Attackers may attempt to brute force user accounts to gain unauthorized access to Microsoft 365 services via different services such as Exchange, SharePoint, or Teams. |[Domain: Cloud], [Domain: SaaS], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |4
 
 |<<azure-event-hub-authorization-rule-created-or-updated, Azure Event Hub Authorization Rule Created or Updated>> |Identifies when an Event Hub Authorization Rule is created or updated in Azure. An authorization rule is associated with specific rights, and carries a pair of cryptographic keys. When you create an Event Hubs namespace, a policy rule named RootManageSharedAccessKey is created for the namespace. This has manage permissions for the entire namespace and it's recommended that you treat this rule like an administrative root account and don't use it in your application. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Collection], [Resources: Investigation Guide] |None |106
 
@@ -454,8 +456,6 @@ and their rule type is `machine_learning`.
 
 |<<azure-resource-group-deletion, Azure Resource Group Deletion>> |Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data. |[Domain: Cloud], [Data Source: Azure], [Use Case: Log Auditing], [Tactic: Impact], [Resources: Investigation Guide] |None |105
 
-|<<azure-service-principal-addition, Azure Service Principal Addition>> |Identifies when a new service principal is added in Azure. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Defense Evasion] |None |107
-
 |<<azure-storage-account-key-regenerated, Azure Storage Account Key Regenerated>> |Identifies a rotation to storage account access keys in Azure. Regenerating access keys can affect any applications or Azure services that are dependent on the storage account key. Adversaries may regenerate a key as a means of acquiring credentials to access systems and resources. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |105
 
 |<<bpf-filter-applied-using-tc, BPF filter applied using TC>> |Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Threat: TripleCross], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |213
@@ -478,7 +478,7 @@ and their rule type is `machine_learning`.
 
 |<<boot-file-copy, Boot File Copy>> |This rule detects the process of copying or moving files from or to the `/boot` directory on Linux systems. The `/boot` directory contains files that are essential for the system to boot, such as the kernel and initramfs images. Attackers may copy or move files to the `/boot` directory to modify the boot process, which can be leveraged to maintain access to the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |4
 
-|<<browser-extension-install, Browser Extension Install>> |Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: SentinelOne], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide] |None |205
+|<<browser-extension-install, Browser Extension Install>> |Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: SentinelOne], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide] |None |206
 
 |<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |319
 
@@ -514,7 +514,7 @@ and their rule type is `machine_learning`.
 
 |<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |210
 
-|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |119
+|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |120
 
 |<<connection-to-external-network-via-telnet, Connection to External Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |211
 
@@ -582,7 +582,7 @@ and their rule type is `machine_learning`.
 
 |<<decline-in-host-based-traffic, Decline in host-based traffic>> |A machine learning job has detected a sudden drop in host based traffic. This can be due to a range of security issues, such as a compromised system, a failed service, or a network misconfiguration. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |3
 
-|<<default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> |This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. |[Tactic: Command and Control], [Threat: Cobalt Strike], [Use Case: Threat Detection], [Domain: Endpoint], [Resources: Investigation Guide] |None |107
+|<<default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> |This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. |[Tactic: Command and Control], [Threat: Cobalt Strike], [Use Case: Threat Detection], [Domain: Endpoint], [Resources: Investigation Guide] |None |108
 
 |<<delayed-execution-via-ping, Delayed Execution via Ping>> |Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often observed during malware installation and is consistent with an attacker attempting to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
@@ -612,6 +612,8 @@ and their rule type is `machine_learning`.
 
 |<<docker-escape-via-nsenter, Docker Escape via Nsenter>> |This rule identifies a UID change event via `nsenter`. The `nsenter` command is used to enter a namespace, which is a way to isolate processes and resources. Attackers can use `nsenter` to escape from a container to the host, which can lead to privilege escalation and lateral movement. |[Domain: Endpoint], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
+|<<docker-release-file-creation, Docker Release File Creation>> |This rule detects the creation of files named release_agent or notify_on_release, which are commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host from within a container. |[Domain: Endpoint], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |None |1
+
 |<<docker-socket-enumeration, Docker Socket Enumeration>> |This rule detects potential Docker socket enumeration activity by monitoring processes that attempt to interact with the Docker socket file (/var/run/docker.sock). Docker socket enumeration is a common technique used by attackers to interact with the Docker daemon and perform various operations, such as creating, starting, stopping, and removing containers. Attackers may abuse Docker socket enumeration to gain unauthorized access to the host system, escalate privileges, or move laterally within the environment. |[Domain: Endpoint], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |3
 
 |<<domain-added-to-google-workspace-trusted-domains, Domain Added to Google Workspace Trusted Domains>> |Detects when a domain is added to the list of trusted Google Workspace domains. An adversary may add a trusted domain in order to collect and exfiltrate data from their target’s organization with less restrictive security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Configuration Audit], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |208
@@ -688,7 +690,7 @@ and their rule type is `machine_learning`.
 
 |<<executable-masquerading-as-kernel-process, Executable Masquerading as Kernel Process>> |Monitors for kernel processes with associated process executable fields that are not empty. Unix kernel processes such as kthreadd and kworker typically do not have process.executable fields associated to them. Attackers may attempt to hide their malicious programs by masquerading as legitimate kernel processes. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |107
 
-|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne] |None |318
+|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne] |None |319
 
 |<<execution-from-a-removable-media-with-network-connection, Execution from a Removable Media with Network Connection>> |Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
@@ -798,7 +800,7 @@ and their rule type is `machine_learning`.
 
 |<<first-time-seen-aws-secret-value-accessed-in-secrets-manager, First Time Seen AWS Secret Value Accessed in Secrets Manager>> |An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service may attempt to leverage the compromised service to access secrets in AWS Secrets Manager. This rule looks for the first time a specific user identity has programmatically retrieved a secret value from Secrets Manager using the `GetSecretValue` or `BatchGetSecretValue` actions. This rule assumes that AWS services such as Lambda functions and EC2 instances are setup with IAM role's assigned that have the necessary permissions to access the secrets in Secrets Manager. An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service would rely on the compromised service's IAM role to access the secrets in Secrets Manager. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS Secrets Manager], [Tactic: Credential Access], [Resources: Investigation Guide] |None |315
 
-|<<first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> |Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Windows Security Event Logs], [Data Source: Sysmon] |None |111
+|<<first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> |Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Windows Security Event Logs], [Data Source: Sysmon] |None |112
 
 |<<first-time-seen-driver-loaded, First Time Seen Driver Loaded>> |Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |11
 
@@ -872,6 +874,8 @@ and their rule type is `machine_learning`.
 
 |<<git-hook-egress-network-connection, Git Hook Egress Network Connection>> |This rule detects a suspicious egress network connection attempt from a Git hook script. Git hooks are scripts that Git executes before or after events such as: commit, push, and receive. An attacker can abuse these features to execute arbitrary commands on the system, establish persistence or to initialize a network connection to a remote server and exfiltrate data or download additional payloads. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
+|<<git-repository-or-file-download-to-suspicious-directory, Git Repository or File Download to Suspicious Directory>> |This rule detects the use of git to clone a repository or download files from GitHub using wget or curl, followed by the creation of files in suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior may indicate an attempt to download a payload, exploit or tool. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |None |1
+
 |<<github-app-deleted, GitHub App Deleted>> |Detects the deletion of a GitHub app either from a repo or an organization. |[Domain: Cloud], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Github], [Resources: Investigation Guide] |None |207
 
 |<<github-owner-role-granted-to-user, GitHub Owner Role Granted To User>> |This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. |[Domain: Cloud], [Use Case: Threat Detection], [Use Case: UEBA], [Tactic: Persistence], [Data Source: Github], [Resources: Investigation Guide] |None |209
@@ -1084,6 +1088,8 @@ and their rule type is `machine_learning`.
 
 |<<linux-system-information-discovery-via-getconf, Linux System Information Discovery via Getconf>> |This rule identifies Linux system information discovery via the `getconf` command. The `getconf` command is used to query system configuration variables and system limits. Adversaries may use this command to gather information about the system, such as the page size, maximum number of open files, and other system limits, to aid in further exploration and exploitation of the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |3
 
+|<<linux-telegram-api-request, Linux Telegram API Request>> |This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend] |None |1
+
 |<<linux-user-account-creation, Linux User Account Creation>> |Identifies attempts to create new users. Attackers may add new users to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |None |9
 
 |<<linux-user-account-credential-modification, Linux User Account Credential Modification>> |This rule detects Linux user account credential modification events where the echo command is used to directly echo a password into the passwd utility. This technique is used by malware to automate the process of user account credential modification on Linux systems post-infection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
@@ -1108,7 +1114,7 @@ and their rule type is `machine_learning`.
 
 |<<ms-office-macro-security-registry-modifications, MS Office Macro Security Registry Modifications>> |Microsoft Office Products offer options for users and developers to control the security settings for running and using Macros. Adversaries may abuse these security settings to modify the default behavior of the Office Application to trust future macros and/or disable security warnings, which could increase their chances of establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |310
 
-|<<machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain, Machine Learning Detected DGA activity using a known SUNBURST DNS domain>> |A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control], [Resources: Investigation Guide] |None |8
+|<<machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain, Machine Learning Detected DGA activity using a known SUNBURST DNS domain>> |A supervised machine learning model has identified a DNS question name that used by the SUNBURST malware and is predicted to be the result of a Domain Generation Algorithm. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control], [Resources: Investigation Guide] |None |9
 
 |<<machine-learning-detected-a-dns-request-predicted-to-be-a-dga-domain, Machine Learning Detected a DNS Request Predicted to be a DGA Domain>> |A supervised machine learning model has identified a DNS question name that is predicted to be the result of a Domain Generation Algorithm (DGA), which could indicate command and control network activity. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control], [Resources: Investigation Guide] |None |8
 
@@ -1128,6 +1134,10 @@ and their rule type is `machine_learning`.
 
 |<<manual-dracut-execution, Manual Dracut Execution>> |This rule detects manual execution of the `dracut` command on Linux systems. Dracut is a tool used to generate an initramfs image that is used to boot the system. Attackers may use `dracut` to create a custom initramfs image that includes malicious code or backdoors, allowing them to maintain persistence on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |5
 
+|<<manual-memory-dumping-via-proc-filesystem, Manual Memory Dumping via Proc Filesystem>> |This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Data Source: Elastic Endgame] |None |1
+
+|<<manual-mount-discovery-via-etc-exports-or-etc-fstab, Manual Mount Discovery via /etc/exports or /etc/fstab>> |This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this file to gather information about shared directories and potential targets for further exploitation. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne] |None |1
+
 |<<masquerading-space-after-filename, Masquerading Space After Filename>> |This rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it's true filetype instead of it's extension. Adversaries can hide a program's true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it's double-clicked. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
 |<<member-removed-from-github-organization, Member Removed From GitHub Organization>> |A member was removed or their invitation to join was removed from a GitHub Organization. |[Domain: Cloud], [Use Case: Threat Detection], [Use Case: UEBA], [Tactic: Impact], [Rule Type: BBR], [Data Source: Github] |None |206
@@ -1170,6 +1180,10 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Collection], [Resources: Investigation Guide] |None |209
 
+|<<microsoft-365-oauth-phishing-via-visual-studio-code-client, Microsoft 365 OAuth Phishing via Visual Studio Code Client>> |Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |1
+
+|<<microsoft-365-oauth-redirect-to-device-registration-for-user-principal, Microsoft 365 OAuth Redirect to Device Registration for User Principal>> |Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |1
+
 |<<microsoft-365-portal-login-from-rare-location, Microsoft 365 Portal Login from Rare Location>> |Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft 365 account from an unusual location or behind a VPN. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |5
 
 |<<microsoft-365-portal-logins-from-impossible-travel-locations, Microsoft 365 Portal Logins from Impossible Travel Locations>> |Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |5
@@ -1186,6 +1200,8 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-365-user-restricted-from-sending-email, Microsoft 365 User Restricted from Sending Email>> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |209
 
+|<<microsoft-azure-or-mail-sign-in-from-a-suspicious-source, Microsoft Azure or Mail Sign-in from a Suspicious Source>> |This rule correlate Azure or Office 356 mail successful sign-in events with network security alerts by source.ip. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in Logs], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide], [Rule Type: Higher-Order Rule] |8.17.0 |1
+
 |<<microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |318
 
 |<<microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |315
@@ -1194,16 +1210,26 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> |An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |315
 
-|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |216
+|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |217
+
+|<<microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties, Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties>> |Identifies concurrent azure signin events for the same user and from multiple sources, and where one of the authentication event has some suspicious properties often associated to DeviceCode and OAuth phishing. Adversaries may steal Refresh Tokens (RTs) via phishing to bypass multi-factor authentication (MFA) and gain unauthorized access to Azure resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |1
 
 |<<microsoft-entra-id-conditional-access-policy-cap-modified, Microsoft Entra ID Conditional Access Policy (CAP) Modified>> |Identifies a modification to a conditional access policy (CAP) in Microsoft Entra ID. Adversaries may modify existing CAPs to loosen access controls and maintain persistence in the environment with a compromised identity or entity. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Use Case: Configuration Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |106
 
 |<<microsoft-entra-id-illicit-consent-grant-via-registered-application, Microsoft Entra ID Illicit Consent Grant via Registered Application>> |Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access], [Tactic: Credential Access] |None |216
 
+|<<microsoft-entra-id-oauth-phishing-via-visual-studio-code-client, Microsoft Entra ID OAuth Phishing via Visual Studio Code Client>> |Detects potentially suspicious OAuth authorization activity in Microsoft Entra ID where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode's Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |3
+
+|<<microsoft-entra-id-protection-anonymized-ip-risk-detection, Microsoft Entra ID Protection Anonymized IP Risk Detection>> |Identifies Microsoft Entra ID Protection risk detections triggered due to sign-in activity from anonymized IP addresses, which is often associated with Tor exit nodes, proxies, or anonymizing VPNs. This behavior may indicate evasion tactics or account compromise activity. |[Domain: Cloud], [Data Source: Azure], [Data Source: Entra ID], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide] |None |1
+
 |<<microsoft-entra-id-rare-authentication-requirement-for-principal-user, Microsoft Entra ID Rare Authentication Requirement for Principal User>> |Identifies rare instances of authentication requirements for Azure Entra ID principal users. An adversary with stolen credentials may attempt to authenticate with unusual authentication requirements, which is a rare event and may indicate an attempt to bypass conditional access policies (CAP) and multi-factor authentication (MFA) requirements. The authentication requirements specified may not be commonly used by the user based on their historical sign-in activity. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |4
 
+|<<microsoft-entra-id-service-principal-created, Microsoft Entra ID Service Principal Created>> |Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |None |108
+
 |<<microsoft-entra-id-service-principal-credentials-added-by-rare-user, Microsoft Entra ID Service Principal Credentials Added by Rare User>> |Identifies when new Service Principal credentials have been added in Microsoft Entra ID. In most organizations, credentials will be added to service principals infrequently. Hijacking an application (by adding a rogue secret or certificate) with granted permissions will allow the attacker to access data that is normally protected by MFA requirements. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |106
 
+|<<microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker, Microsoft Entra ID SharePoint Access for User Principal via Auth Broker>> |This rule detects non-interactive authentication activity against SharePoint Online (`Office 365 SharePoint Online`) by a user principal via the `Microsoft Authentication Broker` application. The session leverages a refresh token or Primary Refresh Token (PRT) without interactive sign-in, often used in OAuth phishing or token replay scenarios. |[Domain: Cloud], [Use Case: Identity and Access Audit], [Tactic: Collection], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Resources: Investigation Guide] |None |1
+
 |<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |315
 
 |<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |311
@@ -1212,6 +1238,8 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |312
 
+|<<microsoft-graph-first-occurrence-of-client-request, Microsoft Graph First Occurrence of Client Request>> |This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |None |1
+
 |<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
 
 |<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR], [Data Source: Windows Security Event Logs] |None |217
@@ -1266,6 +1294,8 @@ and their rule type is `machine_learning`.
 
 |<<multiple-logon-failure-from-the-same-source-address, Multiple Logon Failure from the same Source Address>> |Identifies multiple consecutive logon failures from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs] |None |114
 
+|<<multiple-microsoft-entra-id-protection-alerts-by-user-principal, Multiple Microsoft Entra ID Protection Alerts by User Principal>> |Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Protection Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |1
+
 |<<multiple-okta-sessions-detected-for-a-single-user, Multiple Okta Sessions Detected for a Single User>> |Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Lateral Movement], [Resources: Investigation Guide] |8.15.0 |210
 
 |<<multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy, Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy>> |Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Credential Access], [Resources: Investigation Guide] |8.15.0 |209
@@ -1450,6 +1480,8 @@ and their rule type is `machine_learning`.
 
 |<<potential-azure-openai-model-theft, Potential Azure OpenAI Model Theft>> |Monitors for suspicious activities that may indicate theft or unauthorized duplication of machine learning (ML) models, such as unauthorized API calls, atypical access patterns, or large data transfers that are unusual during model interactions. |[Domain: LLM], [Data Source: Azure OpenAI], [Data Source: Azure Event Hubs], [Use Case: Model Theft], [Mitre Atlas: T0044], [Resources: Investigation Guide] |None |2
 
+|<<potential-backdoor-execution-through-pam-exec, Potential Backdoor Execution Through PAM_EXEC>> |This rule detects SSH session ID change followed by a suspicious SSHD child process, this may indicate the successful execution of a potentially malicious process through the Pluggable Authentication Module (PAM) utility. PAM is a framework used by Linux systems to authenticate users. Adversaries may create malicious PAM modules that grant them persistence onto the target every time a user logs in by executing a backdoor script or command. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Data Source: Elastic Defend] |None |1
+
 |<<potential-buffer-overflow-attack-detected, Potential Buffer Overflow Attack Detected>> |Detects potential buffer overflow attacks by querying the "Segfault Detected" pre-built rule signal index, through a threshold rule, with a minimum number of 100 segfault alerts in a short timespan. A large amount of segfaults in a short time interval could indicate application exploitation attempts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Initial Access], [Use Case: Vulnerability], [Rule Type: Higher-Order Rule], [Resources: Investigation Guide] |None |4
 
 |<<potential-chroot-container-escape-via-mount, Potential Chroot Container Escape via Mount>> |Monitors for the execution of a file system mount followed by a chroot execution. Given enough permissions, a user within a container is capable of mounting the root file system of the host, and leveraging chroot to escape its containarized environment. This behavior pattern is very uncommon and should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Domain: Container], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |106
@@ -1490,6 +1522,8 @@ and their rule type is `machine_learning`.
 
 |<<potential-data-exfiltration-activity-to-an-unusual-region, Potential Data Exfiltration Activity to an Unusual Region>> |A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration], [Resources: Investigation Guide] |None |7
 
+|<<potential-data-exfiltration-through-curl, Potential Data Exfiltration Through Curl>> |Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Exfiltration], [Data Source: Elastic Defend] |None |1
+
 |<<potential-data-splitting-detected, Potential Data Splitting Detected>> |This rule looks for the usage of common data splitting utilities with specific arguments that indicate data splitting for exfiltration on Linux systems. Data splitting is a technique used by adversaries to split data into smaller parts to avoid detection and exfiltrate data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Exfiltration], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |105
 
 |<<potential-defense-evasion-via-cmstp-exe, Potential Defense Evasion via CMSTP.exe>> |The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program to install Connection Manager service profiles, which accept installation information file (INF) files. Adversaries may abuse CMSTP to proxy the execution of malicious code by supplying INF files that contain malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR], [Data Source: Sysmon], [Data Source: Elastic Endgame], [Data Source: Windows Security Event Logs] |None |109
@@ -1504,6 +1538,8 @@ and their rule type is `machine_learning`.
 
 |<<potential-disabling-of-selinux, Potential Disabling of SELinux>> |Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |214
 
+|<<potential-dynamic-iex-reconstruction-via-environment-variables, Potential Dynamic IEX Reconstruction via Environment Variables>> |Identifies PowerShell scripts that reconstruct the IEX (Invoke-Expression) command at runtime using indexed slices of environment variables. This technique leverages character access and join operations to build execution logic dynamically, bypassing static keyword detection and evading defenses such as AMSI. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
 |<<potential-enumeration-via-active-directory-web-service, Potential Enumeration via Active Directory Web Service>> |Identifies processes loading Active Directory related modules followed by a network connection to the ADWS dedicated TCP port. Adversaries may abuse the ADWS Windows service that allows Active Directory to be queried via this web service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
 |<<potential-escalation-via-vulnerable-msi-repair, Potential Escalation via Vulnerable MSI Repair>> |Identifies when a browser process navigates to the Microsoft Help page followed by spawning an elevated process. This may indicate a successful exploitation for privilege escalation abusing a vulnerable Windows Installer repair setup. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide] |None |205
@@ -1528,7 +1564,9 @@ and their rule type is `machine_learning`.
 
 |<<potential-foxmail-exploitation, Potential Foxmail Exploitation>> |Identifies the Foxmail client spawning a child process with argument pointing to the Foxmail temp directory. This may indicate the successful exploitation of a Foxmail vulnerability for initial access and execution via a malicious email. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Windows Security Event Logs], [Data Source: Elastic Endgame], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |206
 
-|<<potential-hex-payload-execution, Potential Hex Payload Execution>> |This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |104
+|<<potential-hex-payload-execution-via-command-line, Potential Hex Payload Execution via Command-Line>> |This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use hexadecimal encoding to obfuscate their payload and evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |None |1
+
+|<<potential-hex-payload-execution-via-common-utility, Potential Hex Payload Execution via Common Utility>> |This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |105
 
 |<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |110
 
@@ -1564,23 +1602,25 @@ and their rule type is `machine_learning`.
 
 |<<potential-linux-tunneling-and-or-port-forwarding, Potential Linux Tunneling and/or Port Forwarding>> |This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |111
 
+|<<potential-linux-tunneling-and-or-port-forwarding-via-ssh-option, Potential Linux Tunneling and/or Port Forwarding via SSH Option>> |This rule detects the use of SSH options that may indicate tunneling or port forwarding on Linux systems. This behavior is commonly associated with malicious activity, such as establishing a port forward, proxy or an encrypted tunnel to exfiltrate data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne] |None |1
+
 |<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |315
 
 |<<potential-malicious-powershell-based-on-alert-correlation, Potential Malicious PowerShell Based on Alert Correlation>> |Identifies PowerShell script blocks associated with multiple distinct detections, indicating likely malicious behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Rule Type: Higher-Order Rule], [Resources: Investigation Guide] |None |1
 
 |<<potential-malware-driven-ssh-brute-force-attempt, Potential Malware-Driven SSH Brute Force Attempt>> |This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ES|QL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
 
-|<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |None |8
+|<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |None |9
 
-|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide] |None |7
+|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide] |None |8
 
-|<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |9
+|<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
-|<<potential-masquerading-as-system32-dll, Potential Masquerading as System32 DLL>> |Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |107
+|<<potential-masquerading-as-system32-dll, Potential Masquerading as System32 DLL>> |Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |108
 
-|<<potential-masquerading-as-system32-executable, Potential Masquerading as System32 Executable>> |Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |7
+|<<potential-masquerading-as-system32-executable, Potential Masquerading as System32 Executable>> |Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |8
 
-|<<potential-masquerading-as-vlc-dll, Potential Masquerading as VLC DLL>> |Identifies instances of VLC-related DLLs which are not signed by the original developer. Attackers may name their payload as legitimate applications to blend into the environment, or embedding its malicious code within legitimate applications to deceive machine learning algorithms by incorporating authentic and benign code. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |6
+|<<potential-masquerading-as-vlc-dll, Potential Masquerading as VLC DLL>> |Identifies instances of VLC-related DLLs which are not signed by the original developer. Attackers may name their payload as legitimate applications to blend into the environment, or embedding its malicious code within legitimate applications to deceive machine learning algorithms by incorporating authentic and benign code. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |None |7
 
 |<<potential-memory-seeking-activity, Potential Memory Seeking Activity>> |Monitors for the execution of Unix utilities that may be leveraged as memory address seekers. Attackers may leverage built-in utilities to seek specific memory addresses, allowing for potential future manipulation/exploitation. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |None |5
 
@@ -1632,6 +1672,24 @@ and their rule type is `machine_learning`.
 
 |<<potential-powershell-obfuscated-script, Potential PowerShell Obfuscated Script>> |Identifies scripts that contain patterns and known methods that obfuscate PowerShell code. Attackers can use obfuscation techniques to bypass PowerShell security protections such as Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |107
 
+|<<potential-powershell-obfuscation-via-backtick-escaped-variable-expansion, Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion>> |Identifies PowerShell scripts that use backtick-escaped characters inside ${} variable expansion as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
+|<<potential-powershell-obfuscation-via-character-array-reconstruction, Potential PowerShell Obfuscation via Character Array Reconstruction>> |Identifies PowerShell scripts that use character arrays and runtime string reconstruction as a form of obfuscation. This technique breaks strings into individual characters, often using constructs like char[] with index-based access or joining logic. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |8.17.0 |1
+
+|<<potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation, Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation>> |Identifies PowerShell scripts that use concatenated strings within dynamic command invocation (&() or .()) as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
+|<<potential-powershell-obfuscation-via-high-numeric-character-proportion, Potential PowerShell Obfuscation via High Numeric Character Proportion>> |Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code manipulation, or embedded encoded strings used to deliver and execute malicious content. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
+|<<potential-powershell-obfuscation-via-high-special-character-proportion, Potential PowerShell Obfuscation via High Special Character Proportion>> |Identifies PowerShell scripts with an abnormally high proportion of non-alphanumeric characters, often resulting from encoding, string mangling, or dynamic code generation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |1
+
+|<<potential-powershell-obfuscation-via-invalid-escape-sequences, Potential PowerShell Obfuscation via Invalid Escape Sequences>> |Identifies PowerShell scripts that use invalid escape sequences as a form of obfuscation. This technique introduces backticks (`) between characters in a way that does not correspond to valid PowerShell escape sequences, breaking up strings and bypassing pattern-based detections while preserving execution logic. This is designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
+|<<potential-powershell-obfuscation-via-reverse-keywords, Potential PowerShell Obfuscation via Reverse Keywords>> |Identifies PowerShell scripts that use reversed strings as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |8.17.0 |1
+
+|<<potential-powershell-obfuscation-via-special-character-overuse, Potential PowerShell Obfuscation via Special Character Overuse>> |Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative of obfuscation. This behavior is commonly associated with techniques such as SecureString encoding, formatting obfuscation, or character-level manipulation designed to bypass static analysis and AMSI inspection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
+|<<potential-powershell-obfuscation-via-string-concatenation, Potential PowerShell Obfuscation via String Concatenation>> |Identifies PowerShell scripts that use string concatenation as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
 |<<potential-powershell-obfuscation-via-string-reordering, Potential PowerShell Obfuscation via String Reordering>> |Identifies PowerShell scripts that use string reordering and runtime reconstruction techniques as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |2
 
 |<<potential-powershell-pass-the-hash-relay-script, Potential PowerShell Pass-the-Hash/Relay Script>> |Detects PowerShell scripts that can execute pass-the-hash (PtH) attacks, intercept and relay NTLM challenges, and carry out other man-in-the-middle (MitM) attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |107
@@ -1672,7 +1730,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-process-injection-via-powershell, Potential Process Injection via PowerShell>> |Detects the use of Windows API functions that are commonly abused by malware and security tools to load malicious code or inject it into remote processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |215
 
-|<<potential-process-name-stomping-with-prctl, Potential Process Name Stomping with Prctl>> |This rule leverages Auditd data to detect the use of the `prctl` syscall to potentially hide a process by changing its name. The `prctl` syscall is used to control various process attributes. Attackers can use this syscall to change the name of a process to a hidden directory or file, making it harder to detect. The query looks for the `prctl` syscall with the `PR_SET_NAME` argument set to `f` (PR_SET_NAME is used to set the name of a process). |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |4
+|<<potential-process-name-stomping-with-prctl, Potential Process Name Stomping with Prctl>> |This rule leverages Auditd data to detect the use of the `prctl` syscall to potentially hide a process by changing its name. The `prctl` syscall is used to control various process attributes. Attackers can use this syscall to change the name of a process to a hidden directory or file, making it harder to detect. The query looks for the `prctl` syscall with the `PR_SET_NAME` argument set to `f` (PR_SET_NAME is used to set the name of a process). |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |5
 
 |<<potential-protocol-tunneling-via-chisel-client, Potential Protocol Tunneling via Chisel Client>> |This rule monitors for common command line flags leveraged by the Chisel client utility followed by a connection attempt. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
@@ -1760,7 +1818,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-widespread-malware-infection-across-multiple-hosts, Potential Widespread Malware Infection Across Multiple Hosts>> |This rule uses alert data to determine when a malware signature is triggered in multiple hosts. Analysts can use this to prioritize triage and response, as this can potentially indicate a widespread malware infection. |[Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Threat Detection], [Tactic: Execution], [Rule Type: Higher-Order Rule], [Resources: Investigation Guide] |None |3
 
-|<<potential-windows-error-manager-masquerading, Potential Windows Error Manager Masquerading>> |Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |212
+|<<potential-windows-error-manager-masquerading, Potential Windows Error Manager Masquerading>> |Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |213
 
 |<<potential-windows-session-hijacking-via-ccmexec, Potential Windows Session Hijacking via CcmExec>> |This detection rule identifies when 'SCNotification.exe' loads an untrusted DLL, which is a potential indicator of an attacker attempt to hijack/impersonate a Windows user session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
@@ -1786,6 +1844,8 @@ and their rule type is `machine_learning`.
 
 |<<powershell-minidump-script, PowerShell MiniDump Script>> |This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |212
 
+|<<powershell-obfuscation-via-negative-index-string-reversal, PowerShell Obfuscation via Negative Index String Reversal>> |Identifies PowerShell scripts that use negative index ranges to reverse the contents of a string or array at runtime as a form of obfuscation. This technique avoids direct use of reversal functions by iterating through array elements in reverse order. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs] |None |1
+
 |<<powershell-psreflect-script, PowerShell PSReflect Script>> |Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |316
 
 |<<powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> |Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |312
@@ -1866,7 +1926,7 @@ and their rule type is `machine_learning`.
 
 |<<process-discovery-via-built-in-applications, Process Discovery via Built-In Applications>> |Identifies the use of built-in tools attackers can use to discover running processes on an endpoint. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |None |5
 
-|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |317
+|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |318
 
 |<<process-injection-detected-elastic-endgame, Process Injection - Detected - Elastic Endgame>> |Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide] |None |105
 
@@ -1884,7 +1944,7 @@ and their rule type is `machine_learning`.
 
 |<<processes-with-trailing-spaces, Processes with Trailing Spaces>> |Identify instances where adversaries include trailing space characters to mimic regular files, disguising their activity to evade default file handling mechanisms. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |4
 
-|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
+|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |317
 
 |<<prompt-for-credentials-with-osascript, Prompt for Credentials with Osascript>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |213
 
@@ -1922,10 +1982,12 @@ and their rule type is `machine_learning`.
 
 |<<rapid-secret-retrieval-attempts-from-aws-secretsmanager, Rapid Secret Retrieval Attempts from AWS SecretsManager>> |This rule attempts to identify rapid secret retrieval attempts from AWS SecretsManager. Adversaries may attempt to retrieve secrets from the Secrets Manager programmatically using the `GetSecretValue` or `BatchGetSecretValue` API actions. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS Secrets Manager], [Tactic: Credential Access], [Resources: Investigation Guide] |None |5
 
-|<<rapid7-threat-command-cves-correlation, Rapid7 Threat Command CVEs Correlation>> |This rule is triggered when CVEs collected from the Rapid7 Threat Command Integration have a match against vulnerabilities that were found in the customer environment. |[OS: Windows], [Data Source: Elastic Endgame], [Data Source: Windows], [Data Source: Network], [Data Source: Rapid7 Threat Command], [Rule Type: Threat Match], [Resources: Investigation Guide], [Use Case: Vulnerability], [Use Case: Asset Visibility], [Use Case: Continuous Monitoring] |None |106
+|<<rapid7-threat-command-cves-correlation, Rapid7 Threat Command CVEs Correlation>> |This rule is triggered when CVEs collected from the Rapid7 Threat Command Integration have a match against vulnerabilities that were found in the customer environment. |[OS: Windows], [Data Source: Elastic Endgame], [Data Source: Windows], [Data Source: Network], [Data Source: Rapid7 Threat Command], [Rule Type: Threat Match], [Resources: Investigation Guide], [Use Case: Vulnerability], [Use Case: Asset Visibility], [Use Case: Continuous Monitoring] |None |107
 
 |<<rare-aws-error-code, Rare AWS Error Code>> |A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |211
 
+|<<rare-connection-to-webdav-target, Rare Connection to WebDAV Target>> |Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |8.17.0 |1
+
 |<<rare-smb-connection-to-the-internet, Rare SMB Connection to the Internet>> |This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |211
 
 |<<rare-user-logon, Rare User Logon>> |A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access], [Resources: Investigation Guide] |None |107
@@ -1944,7 +2006,7 @@ and their rule type is `machine_learning`.
 
 |<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
 
-|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: SentinelOne] |None |215
+|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: SentinelOne] |None |216
 
 |<<remote-file-creation-in-world-writeable-directory, Remote File Creation in World Writeable Directory>> |This rule detects the creation of a file in a world-writeable directory through a service that is commonly used for file transfer. This behavior is often associated with lateral movement and can be an indicator of an attacker attempting to move laterally within a network. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
 
@@ -1970,9 +2032,9 @@ and their rule type is `machine_learning`.
 
 |<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |216
 
-|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |214
+|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |215
 
-|<<renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> |Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |213
+|<<renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> |Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |214
 
 |<<root-certificate-installation, Root Certificate Installation>> |This rule detects the installation of root certificates on a Linux system. Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |105
 
@@ -2148,7 +2210,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> |Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |319
 
-|<<suspicious-proc-maps-discovery, Suspicious /proc/maps Discovery>> |Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
+|<<suspicious-proc-maps-discovery, Suspicious /proc/maps Discovery>> |Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |7
 
 |<<suspicious-apt-package-manager-execution, Suspicious APT Package Manager Execution>> |Detects suspicious process events executed by the APT package manager, potentially indicating persistence through an APT backdoor. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |108
 
@@ -2158,11 +2220,11 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-activity-reported-by-okta-user, Suspicious Activity Reported by Okta User>> |Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access], [Resources: Investigation Guide] |8.15.0 |412
 
-|<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint] |None |317
+|<<suspicious-activity-via-auth-broker-on-behalf-of-principal-user, Suspicious Activity via Auth Broker On-Behalf-of Principal User>> |Identifies suspicious activity from the Microsoft Authentication Broker in Microsoft Entra ID sign-in logs. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to register a device and access Microsoft services as a user. The pattern includes sign-ins from multiple IPs across services (Microsoft Graph, DRS, AAD) using the Authentication Broker client on behalf of a principal user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Defense Evasion], [Tactic: Persistence] |8.17.0 |1
 
-|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111
+|<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint] |None |318
 
-|<<suspicious-azure-sign-in-via-visual-studio-code, Suspicious Azure Sign-in via Visual Studio Code>> |Identifies login activity where the Visual Studio Code `client_id` is used in combination with a resourceDisplayName containing `Microsoft Graph`. This may indicate an attempt to authenticate via Visual Studio Code phishing. |[Domain: Cloud], [Data Source: Azure], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |2
+|<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111
 
 |<<suspicious-browser-child-process, Suspicious Browser Child Process>> |Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |112
 
@@ -2174,13 +2236,13 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |318
 
-|<<suspicious-communication-app-child-process, Suspicious Communication App Child Process>> |Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |9
+|<<suspicious-communication-app-child-process, Suspicious Communication App Child Process>> |Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
 |<<suspicious-content-extracted-or-decompressed-via-funzip, Suspicious Content Extracted or Decompressed via Funzip>> |Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the "-c" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |109
 
 |<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111
 
-|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |216
+|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |217
 
 |<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
@@ -2188,7 +2250,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |112
 
-|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |317
+|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |318
 
 |<<suspicious-execution-from-foomatic-rip-or-cupsd-parent, Suspicious Execution from Foomatic-rip or Cupsd Parent>> |This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Use Case: Vulnerability], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |106
 
@@ -2226,6 +2288,8 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-jetbrains-teamcity-child-process, Suspicious JetBrains TeamCity Child Process>> |Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |207
 
+|<<suspicious-kernel-feature-activity, Suspicious Kernel Feature Activity>> |This rule detects the modification and reading of kernel features through built-in commands. Attackers may collect information, disable or weaken Linux kernel protections. For example, an attacker may modify ASLR protection by disabling kernel.randomize_va_space, allow ptrace by setting kernel.yama.ptrace_scope to 0, or disable the NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to impair defenses and evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Discovery], [Data Source: Elastic Defend] |None |1
+
 |<<suspicious-kworker-uid-elevation, Suspicious Kworker UID Elevation>> |Monitors for the elevation of regular user permissions to root permissions through the kworker process. kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks. Attackers may attempt to evade detection by masquerading as a kernel worker process, and hijack the execution flow by hooking certain functions/syscalls through a rootkit in order to provide easy access to root via a special modified command. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |6
 
 |<<suspicious-lsass-access-via-malseclogon, Suspicious LSASS Access via MalSecLogon>> |Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon], [Resources: Investigation Guide] |None |311
@@ -2242,6 +2306,8 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-microsoft-365-mail-access-by-clientappid, Suspicious Microsoft 365 Mail Access by ClientAppId>> |Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |110
 
+|<<suspicious-microsoft-365-userloggedin-via-oauth-code, Suspicious Microsoft 365 UserLoggedIn via OAuth Code>> |Identifies sign-ins on behalf of a principal user to the Microsoft Graph API from multiple IPs using the Microsoft Authentication Broker or Visual Studio Code application. This behavior may indicate an adversary using a phished OAuth refresh token. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Defense Evasion] |8.17.0 |1
+
 |<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Resources: Investigation Guide] |None |213
 
 |<<suspicious-mining-process-creation-event, Suspicious Mining Process Creation Event>> |Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |110
@@ -2250,13 +2316,15 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> |Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |12
 
+|<<suspicious-named-pipe-creation, Suspicious Named Pipe Creation>> |This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend] |None |1
+
 |<<suspicious-network-activity-to-the-internet-by-previously-unknown-executable, Suspicious Network Activity to the Internet by Previously Unknown Executable>> |This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |14
 
 |<<suspicious-network-connection-via-systemd, Suspicious Network Connection via systemd>> |Detects suspicious network events executed by systemd, potentially indicating persistence through a systemd backdoor. Systemd is a system and service manager for Linux operating systems, used to initialize and manage system processes. Attackers can backdoor systemd for persistence by creating or modifying systemd unit files to execute malicious scripts or commands, or by replacing legitimate systemd binaries with compromised ones, ensuring that their malicious code is automatically executed at system startup or during certain system events. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Command and Control], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |7
 
 |<<suspicious-network-tool-launched-inside-a-container, Suspicious Network Tool Launched Inside A Container>> |This rule detects commonly abused network utilities running inside a container. Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation, and should be monitored closely within a container. |[Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Command and Control], [Tactic: Reconnaissance], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |2
 
-|<<suspicious-outlook-child-process, Suspicious Outlook Child Process>> |Identifies suspicious child processes spawned by MS Outlook, which can indicate a potential masquerading or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |None |3
+|<<suspicious-outlook-child-process, Suspicious Outlook Child Process>> |Identifies suspicious child processes spawned by MS Outlook, which can indicate a potential masquerading or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |None |4
 
 |<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
 
@@ -2264,6 +2332,8 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-path-invocation-from-command-line, Suspicious Path Invocation from Command Line>> |This rule detects the execution of a PATH variable in a command line invocation by a shell process. This behavior is unusual and may indicate an attempt to execute a command from a non-standard location. This technique may be used to evade detection or perform unauthorized actions on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
+|<<suspicious-path-mounted, Suspicious Path Mounted>> |This rule detects suspicious paths mounted on Linux systems. The mount command is used to attach filesystems to the system, and attackers may use it to mount malicious filesystems or directories for data exfiltration or persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |None |1
+
 |<<suspicious-portable-executable-encoded-in-powershell-script, Suspicious Portable Executable Encoded in Powershell Script>> |Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |215
 
 |<<suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> |Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |213
@@ -2284,17 +2354,17 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-process-creation-calltrace, Suspicious Process Creation CallTrace>> |Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Sysmon] |None |310
 
-|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |214
+|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |215
 
 |<<suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> |Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |213
 
 |<<suspicious-remote-registry-access-via-sebackupprivilege, Suspicious Remote Registry Access via SeBackupPrivilege>> |Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Data Source: Windows Security Event Logs] |None |215
 
-|<<suspicious-renaming-of-esxi-files, Suspicious Renaming of ESXI Files>> |Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
+|<<suspicious-renaming-of-esxi-files, Suspicious Renaming of ESXI Files>> |Identifies instances where VMware-related files, such as those with extensions like ".vmdk", ".vmx", ".vmxf", ".vmsd", ".vmsn", ".vswp", ".vmss", ".nvram", and ".vmem", are renamed on a Linux system. The rule monitors for the "rename" event action associated with these file types, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |11
 
-|<<suspicious-renaming-of-esxi-index-html-file, Suspicious Renaming of ESXI index.html File>> |Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
+|<<suspicious-renaming-of-esxi-index-html-file, Suspicious Renaming of ESXI index.html File>> |Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |11
 
-|<<suspicious-screenconnect-client-child-process, Suspicious ScreenConnect Client Child Process>> |Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike] |None |311
+|<<suspicious-screenconnect-client-child-process, Suspicious ScreenConnect Client Child Process>> |Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike] |None |312
 
 |<<suspicious-script-object-execution, Suspicious Script Object Execution>> |Identifies scrobj.dll loaded into unusual Microsoft processes. This usually means a malicious scriptlet is being executed in the target process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Sysmon], [Resources: Investigation Guide] |None |212
 
@@ -2346,10 +2416,12 @@ and their rule type is `machine_learning`.
 
 |<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
 
-|<<system-binary-moved-or-copied, System Binary Moved or Copied>> |This rule monitors for the copying or moving of a system binary. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |16
+|<<system-binary-moved-or-copied, System Binary Moved or Copied>> |This rule monitors for the copying or moving of a system binary. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |17
 
 |<<system-binary-path-file-permission-modification, System Binary Path File Permission Modification>> |This rule identifies file permission modification events on files located in common system binary paths. Adversaries may attempt to hide their payloads in the default Linux system directories, and modify the file permissions of these payloads prior to execution. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
+|<<system-binary-symlink-to-suspicious-location, System Binary Symlink to Suspicious Location>> |This rule detects the creation of a symbolic link from a system binary to a suspicious and writable location. This activity may indicate an attacker's attempt to evade detection by behavioral rules that depend on predefined process parent/child relationships. By executing the symlinked variant of a binary instead of the original, the attacker aims to bypass these rules. Through the new_terms rule type, this rule can identify uncommon parent processes that may indicate the presence of a malicious symlink. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |None |1
+
 |<<system-hosts-file-access, System Hosts File Access>> |Identifies the use of built-in tools to read the contents of \etc\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |5
 
 |<<system-information-discovery-via-windows-command-shell, System Information Discovery via Windows Command Shell>> |Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Rule Type: BBR], [Data Source: Elastic Endgame], [Data Source: Windows Security Event Logs] |None |118
@@ -2394,15 +2466,15 @@ and their rule type is `machine_learning`.
 
 |<<third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> |Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne] |None |215
 
-|<<threat-intel-email-indicator-match, Threat Intel Email Indicator Match>> |This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers. |[Rule Type: Threat Match], [Resources: Investigation Guide] |None |1
+|<<threat-intel-email-indicator-match, Threat Intel Email Indicator Match>> |This rule is triggered when an email indicator from the Threat Intel Filebeat module or integrations matches an event containing email-related data, such as logs from email security gateways or email service providers. |[Rule Type: Threat Match], [Resources: Investigation Guide] |None |2
 
-|<<threat-intel-hash-indicator-match, Threat Intel Hash Indicator Match>> |This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |9
+|<<threat-intel-hash-indicator-match, Threat Intel Hash Indicator Match>> |This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |10
 
-|<<threat-intel-ip-address-indicator-match, Threat Intel IP Address Indicator Match>> |This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |8
+|<<threat-intel-ip-address-indicator-match, Threat Intel IP Address Indicator Match>> |This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |9
 
-|<<threat-intel-url-indicator-match, Threat Intel URL Indicator Match>> |This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |8
+|<<threat-intel-url-indicator-match, Threat Intel URL Indicator Match>> |This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |9
 
-|<<threat-intel-windows-registry-indicator-match, Threat Intel Windows Registry Indicator Match>> |This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |8
+|<<threat-intel-windows-registry-indicator-match, Threat Intel Windows Registry Indicator Match>> |This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Threat Match], [Resources: Investigation Guide] |None |9
 
 |<<timestomping-using-touch-command, Timestomping using Touch Command>> |Timestomping is an anti-forensics technique which is used to modify the timestamps of a file, often to mimic files that are in the same folder. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |109
 
@@ -2412,7 +2484,7 @@ and their rule type is `machine_learning`.
 
 |<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> |Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |312
 
-|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |319
+|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |320
 
 |<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> |Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |312
 
@@ -2442,7 +2514,7 @@ and their rule type is `machine_learning`.
 
 |<<unsigned-dll-loaded-by-svchost, Unsigned DLL Loaded by Svchost>> |Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
-|<<unsigned-dll-loaded-by-a-trusted-process, Unsigned DLL Loaded by a Trusted Process>> |Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers may plant their payloads into the application folder and invoke the legitimate application to execute the payload, masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |None |104
+|<<unsigned-dll-loaded-by-a-trusted-process, Unsigned DLL Loaded by a Trusted Process>> |Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers may plant their payloads into the application folder and invoke the legitimate application to execute the payload, masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |None |105
 
 |<<unsigned-dll-side-loading-from-a-suspicious-folder, Unsigned DLL Side-Loading from a Suspicious Folder>> |Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |12
 
@@ -2484,8 +2556,12 @@ and their rule type is `machine_learning`.
 
 |<<unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> |Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |314
 
+|<<unusual-execution-from-kernel-thread-kthreadd-parent, Unusual Execution from Kernel Thread (kthreadd) Parent>> |This rule detects suspicious child process from the kernel thread (kthreadd) parent process. Attackers may execute payloads from kernel space via kthreadd to perform actions on the host and evade detection. Through the usage of the new_terms rule type, this rule can identify uncommon child processes that may indicate the presence of a malicious process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |None |1
+
 |<<unusual-execution-via-microsoft-common-console-file, Unusual Execution via Microsoft Common Console File>> |Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |204
 
+|<<unusual-exim4-child-process, Unusual Exim4 Child Process>> |This rule detects the execution of unusual commands via a descendant process of exim4. Attackers may use descendant processes of exim4 to evade detection and establish persistence or execute post-exploitation commands on a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |None |1
+
 |<<unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> |Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Elastic Endgame] |None |318
 
 |<<unusual-file-creation-by-web-server, Unusual File Creation by Web Server>> |This rule detects unusual file creations from a web server parent process. Adversaries may attempt to create files from a web server parent process to establish persistence, execute malicious scripts, or exfiltrate data. ES|QL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Rule Type: BBR] |None |3
@@ -2510,6 +2586,8 @@ and their rule type is `machine_learning`.
 
 |<<unusual-interactive-shell-launched-from-system-user, Unusual Interactive Shell Launched from System User>> |This rule detects interactive shells launched from system users. System users typically do not require interactive shells, and their presence may indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
+|<<unusual-ld-preload-ld-library-path-command-line-arguments, Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments>> |This rule detects the use of the LD_PRELOAD and LD_LIBRARY_PATH environment variables in a command line argument. This behavior is unusual and may indicate an attempt to hijack the execution flow of a process. Threat actors may use this technique to evade defenses, escalate privileges, or maintain persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Defend] |None |1
+
 |<<unusual-linux-network-activity, Unusual Linux Network Activity>> |Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |107
 
 |<<unusual-linux-network-configuration-discovery, Unusual Linux Network Configuration Discovery>> |Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Discovery], [Resources: Investigation Guide] |None |108
@@ -2532,7 +2610,7 @@ and their rule type is `machine_learning`.
 
 |<<unusual-login-activity, Unusual Login Activity>> |Identifies an unusually high number of authentication attempts. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access], [Resources: Investigation Guide] |None |107
 
-|<<unusual-network-activity-from-a-windows-system-binary, Unusual Network Activity from a Windows System Binary>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |216
+|<<unusual-network-activity-from-a-windows-system-binary, Unusual Network Activity from a Windows System Binary>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |217
 
 |<<unusual-network-connection-to-suspicious-top-level-domain, Unusual Network Connection to Suspicious Top Level Domain>> |This rule monitors for the unusual occurrence of outbound network connections to suspicious top level domains. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
 
@@ -2636,9 +2714,9 @@ and their rule type is `machine_learning`.
 
 |<<user-or-group-creation-modification, User or Group Creation/Modification>> |This rule leverages the `auditd_manager` integration to detect user or group creation or modification events on Linux systems. Threat actors may attempt to create or modify users or groups to establish persistence on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Auditd Manager], [Resources: Investigation Guide] |None |6
 
-|<<vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> |This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |108
+|<<vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> |This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |109
 
-|<<vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> |This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |108
+|<<vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> |This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |109
 
 |<<veeam-backup-library-loaded-by-unusual-process, Veeam Backup Library Loaded by Unusual Process>> |Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
@@ -2702,6 +2780,8 @@ and their rule type is `machine_learning`.
 
 |<<windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> |Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |111
 
+|<<windows-sandbox-with-sensitive-configuration, Windows Sandbox with Sensitive Configuration>> |Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write access to the host file system, network connection and automatic execution via logon command. Malware may abuse the sandbox feature to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |1
+
 |<<windows-script-executing-powershell, Windows Script Executing PowerShell>> |Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |314
 
 |<<windows-script-interpreter-executing-process-via-wmi, Windows Script Interpreter Executing Process via WMI>> |Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |213
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 59b36b423d..5e79faf66e 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -97,6 +97,7 @@ include::rule-details/aws-s3-bucket-replicated-to-another-account.asciidoc[]
 include::rule-details/aws-s3-bucket-server-access-logging-disabled.asciidoc[]
 include::rule-details/aws-s3-object-encryption-using-external-kms-key.asciidoc[]
 include::rule-details/aws-s3-object-versioning-suspended.asciidoc[]
+include::rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc[]
 include::rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc[]
 include::rule-details/aws-sns-email-subscription-by-rare-user.asciidoc[]
 include::rule-details/aws-sns-topic-created-by-rare-user.asciidoc[]
@@ -218,7 +219,6 @@ include::rule-details/azure-network-watcher-deletion.asciidoc[]
 include::rule-details/azure-openai-insecure-output-handling.asciidoc[]
 include::rule-details/azure-privilege-identity-management-role-modified.asciidoc[]
 include::rule-details/azure-resource-group-deletion.asciidoc[]
-include::rule-details/azure-service-principal-addition.asciidoc[]
 include::rule-details/azure-storage-account-key-regenerated.asciidoc[]
 include::rule-details/bpf-filter-applied-using-tc.asciidoc[]
 include::rule-details/base16-or-base32-encoding-decoding-activity.asciidoc[]
@@ -297,6 +297,7 @@ include::rule-details/disabling-windows-defender-security-settings-via-powershel
 include::rule-details/discovery-of-domain-groups.asciidoc[]
 include::rule-details/discovery-of-internet-capabilities-via-built-in-tools.asciidoc[]
 include::rule-details/docker-escape-via-nsenter.asciidoc[]
+include::rule-details/docker-release-file-creation.asciidoc[]
 include::rule-details/docker-socket-enumeration.asciidoc[]
 include::rule-details/domain-added-to-google-workspace-trusted-domains.asciidoc[]
 include::rule-details/downloaded-shortcut-files.asciidoc[]
@@ -427,6 +428,7 @@ include::rule-details/git-hook-child-process.asciidoc[]
 include::rule-details/git-hook-command-execution.asciidoc[]
 include::rule-details/git-hook-created-or-modified.asciidoc[]
 include::rule-details/git-hook-egress-network-connection.asciidoc[]
+include::rule-details/git-repository-or-file-download-to-suspicious-directory.asciidoc[]
 include::rule-details/github-app-deleted.asciidoc[]
 include::rule-details/github-owner-role-granted-to-user.asciidoc[]
 include::rule-details/github-pat-access-revoked.asciidoc[]
@@ -533,6 +535,7 @@ include::rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciido
 include::rule-details/linux-ssh-x11-forwarding.asciidoc[]
 include::rule-details/linux-system-information-discovery.asciidoc[]
 include::rule-details/linux-system-information-discovery-via-getconf.asciidoc[]
+include::rule-details/linux-telegram-api-request.asciidoc[]
 include::rule-details/linux-user-account-creation.asciidoc[]
 include::rule-details/linux-user-account-credential-modification.asciidoc[]
 include::rule-details/linux-user-added-to-privileged-group.asciidoc[]
@@ -555,6 +558,8 @@ include::rule-details/malicious-file-prevented-elastic-defend.asciidoc[]
 include::rule-details/malware-detected-elastic-endgame.asciidoc[]
 include::rule-details/malware-prevented-elastic-endgame.asciidoc[]
 include::rule-details/manual-dracut-execution.asciidoc[]
+include::rule-details/manual-memory-dumping-via-proc-filesystem.asciidoc[]
+include::rule-details/manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc[]
 include::rule-details/masquerading-space-after-filename.asciidoc[]
 include::rule-details/member-removed-from-github-organization.asciidoc[]
 include::rule-details/memory-dump-file-with-unusual-extension.asciidoc[]
@@ -576,6 +581,8 @@ include::rule-details/microsoft-365-exchange-transport-rule-modification.asciido
 include::rule-details/microsoft-365-global-administrator-role-assigned.asciidoc[]
 include::rule-details/microsoft-365-illicit-consent-grant-via-registered-application.asciidoc[]
 include::rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc[]
+include::rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc[]
+include::rule-details/microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc[]
 include::rule-details/microsoft-365-portal-login-from-rare-location.asciidoc[]
 include::rule-details/microsoft-365-portal-logins-from-impossible-travel-locations.asciidoc[]
 include::rule-details/microsoft-365-potential-ransomware-activity.asciidoc[]
@@ -584,19 +591,26 @@ include::rule-details/microsoft-365-teams-external-access-enabled.asciidoc[]
 include::rule-details/microsoft-365-teams-guest-access-enabled.asciidoc[]
 include::rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc[]
 include::rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc[]
+include::rule-details/microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc[]
 include::rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc[]
 include::rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc[]
 include::rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc[]
 include::rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc[]
 include::rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc[]
+include::rule-details/microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc[]
 include::rule-details/microsoft-entra-id-conditional-access-policy-cap-modified.asciidoc[]
 include::rule-details/microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc[]
+include::rule-details/microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc[]
+include::rule-details/microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc[]
 include::rule-details/microsoft-entra-id-rare-authentication-requirement-for-principal-user.asciidoc[]
+include::rule-details/microsoft-entra-id-service-principal-created.asciidoc[]
 include::rule-details/microsoft-entra-id-service-principal-credentials-added-by-rare-user.asciidoc[]
+include::rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc[]
 include::rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc[]
 include::rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc[]
 include::rule-details/microsoft-exchange-transport-agent-install-script.asciidoc[]
 include::rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc[]
+include::rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc[]
 include::rule-details/microsoft-iis-connection-strings-decryption.asciidoc[]
 include::rule-details/microsoft-iis-service-account-password-dumped.asciidoc[]
 include::rule-details/microsoft-management-console-file-from-unusual-path.asciidoc[]
@@ -624,6 +638,7 @@ include::rule-details/multiple-alerts-in-different-att-ck-tactics-on-a-single-ho
 include::rule-details/multiple-device-token-hashes-for-single-okta-session.asciidoc[]
 include::rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc[]
 include::rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc[]
+include::rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc[]
 include::rule-details/multiple-okta-sessions-detected-for-a-single-user.asciidoc[]
 include::rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc[]
 include::rule-details/multiple-okta-user-authentication-events-with-client-address.asciidoc[]
@@ -716,6 +731,7 @@ include::rule-details/potential-admin-group-account-addition.asciidoc[]
 include::rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc[]
 include::rule-details/potential-application-shimming-via-sdbinst.asciidoc[]
 include::rule-details/potential-azure-openai-model-theft.asciidoc[]
+include::rule-details/potential-backdoor-execution-through-pam-exec.asciidoc[]
 include::rule-details/potential-buffer-overflow-attack-detected.asciidoc[]
 include::rule-details/potential-chroot-container-escape-via-mount.asciidoc[]
 include::rule-details/potential-code-execution-via-postgresql.asciidoc[]
@@ -736,6 +752,7 @@ include::rule-details/potential-data-exfiltration-activity-to-an-unusual-destina
 include::rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc[]
 include::rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc[]
 include::rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc[]
+include::rule-details/potential-data-exfiltration-through-curl.asciidoc[]
 include::rule-details/potential-data-splitting-detected.asciidoc[]
 include::rule-details/potential-defense-evasion-via-cmstp-exe.asciidoc[]
 include::rule-details/potential-defense-evasion-via-doas.asciidoc[]
@@ -743,6 +760,7 @@ include::rule-details/potential-defense-evasion-via-proot.asciidoc[]
 include::rule-details/potential-denial-of-azure-openai-ml-service.asciidoc[]
 include::rule-details/potential-disabling-of-apparmor.asciidoc[]
 include::rule-details/potential-disabling-of-selinux.asciidoc[]
+include::rule-details/potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc[]
 include::rule-details/potential-enumeration-via-active-directory-web-service.asciidoc[]
 include::rule-details/potential-escalation-via-vulnerable-msi-repair.asciidoc[]
 include::rule-details/potential-evasion-via-filter-manager.asciidoc[]
@@ -755,7 +773,8 @@ include::rule-details/potential-file-download-via-a-headless-browser.asciidoc[]
 include::rule-details/potential-file-transfer-via-certreq.asciidoc[]
 include::rule-details/potential-file-transfer-via-curl-for-windows.asciidoc[]
 include::rule-details/potential-foxmail-exploitation.asciidoc[]
-include::rule-details/potential-hex-payload-execution.asciidoc[]
+include::rule-details/potential-hex-payload-execution-via-command-line.asciidoc[]
+include::rule-details/potential-hex-payload-execution-via-common-utility.asciidoc[]
 include::rule-details/potential-hidden-local-user-account-creation.asciidoc[]
 include::rule-details/potential-hidden-process-via-mount-hidepid.asciidoc[]
 include::rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc[]
@@ -773,6 +792,7 @@ include::rule-details/potential-linux-hack-tool-launched.asciidoc[]
 include::rule-details/potential-linux-local-account-brute-force-detected.asciidoc[]
 include::rule-details/potential-linux-ransomware-note-creation-detected.asciidoc[]
 include::rule-details/potential-linux-tunneling-and-or-port-forwarding.asciidoc[]
+include::rule-details/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc[]
 include::rule-details/potential-local-ntlm-relay-via-http.asciidoc[]
 include::rule-details/potential-malicious-powershell-based-on-alert-correlation.asciidoc[]
 include::rule-details/potential-malware-driven-ssh-brute-force-attempt.asciidoc[]
@@ -807,6 +827,15 @@ include::rule-details/potential-port-scanning-activity-from-compromised-host.asc
 include::rule-details/potential-powershell-hacktool-script-by-author.asciidoc[]
 include::rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc[]
 include::rule-details/potential-powershell-obfuscated-script.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-high-special-character-proportion.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-reverse-keywords.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-special-character-overuse.asciidoc[]
+include::rule-details/potential-powershell-obfuscation-via-string-concatenation.asciidoc[]
 include::rule-details/potential-powershell-obfuscation-via-string-reordering.asciidoc[]
 include::rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc[]
@@ -884,6 +913,7 @@ include::rule-details/powershell-kerberos-ticket-request.asciidoc[]
 include::rule-details/powershell-keylogging-script.asciidoc[]
 include::rule-details/powershell-mailbox-collection-script.asciidoc[]
 include::rule-details/powershell-minidump-script.asciidoc[]
+include::rule-details/powershell-obfuscation-via-negative-index-string-reversal.asciidoc[]
 include::rule-details/powershell-psreflect-script.asciidoc[]
 include::rule-details/powershell-script-block-logging-disabled.asciidoc[]
 include::rule-details/powershell-script-with-archive-compression-capabilities.asciidoc[]
@@ -954,6 +984,7 @@ include::rule-details/ransomware-prevented-elastic-endgame.asciidoc[]
 include::rule-details/rapid-secret-retrieval-attempts-from-aws-secretsmanager.asciidoc[]
 include::rule-details/rapid7-threat-command-cves-correlation.asciidoc[]
 include::rule-details/rare-aws-error-code.asciidoc[]
+include::rule-details/rare-connection-to-webdav-target.asciidoc[]
 include::rule-details/rare-smb-connection-to-the-internet.asciidoc[]
 include::rule-details/rare-user-logon.asciidoc[]
 include::rule-details/registry-persistence-via-appcert-dll.asciidoc[]
@@ -1070,9 +1101,9 @@ include::rule-details/suspicious-apt-package-manager-execution.asciidoc[]
 include::rule-details/suspicious-apt-package-manager-network-connection.asciidoc[]
 include::rule-details/suspicious-access-to-ldap-attributes.asciidoc[]
 include::rule-details/suspicious-activity-reported-by-okta-user.asciidoc[]
+include::rule-details/suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc[]
 include::rule-details/suspicious-antimalware-scan-interface-dll.asciidoc[]
 include::rule-details/suspicious-automator-workflows-execution.asciidoc[]
-include::rule-details/suspicious-azure-sign-in-via-visual-studio-code.asciidoc[]
 include::rule-details/suspicious-browser-child-process.asciidoc[]
 include::rule-details/suspicious-calendar-file-modification.asciidoc[]
 include::rule-details/suspicious-certutil-commands.asciidoc[]
@@ -1104,6 +1135,7 @@ include::rule-details/suspicious-imagepath-service-creation.asciidoc[]
 include::rule-details/suspicious-installer-package-spawns-network-event.asciidoc[]
 include::rule-details/suspicious-inter-process-communication-via-outlook.asciidoc[]
 include::rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc[]
+include::rule-details/suspicious-kernel-feature-activity.asciidoc[]
 include::rule-details/suspicious-kworker-uid-elevation.asciidoc[]
 include::rule-details/suspicious-lsass-access-via-malseclogon.asciidoc[]
 include::rule-details/suspicious-lsass-process-access.asciidoc[]
@@ -1112,10 +1144,12 @@ include::rule-details/suspicious-ms-outlook-child-process.asciidoc[]
 include::rule-details/suspicious-managed-code-hosting-process.asciidoc[]
 include::rule-details/suspicious-memory-grep-activity.asciidoc[]
 include::rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc[]
+include::rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc[]
 include::rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc[]
 include::rule-details/suspicious-mining-process-creation-event.asciidoc[]
 include::rule-details/suspicious-modprobe-file-event.asciidoc[]
 include::rule-details/suspicious-module-loaded-by-lsass.asciidoc[]
+include::rule-details/suspicious-named-pipe-creation.asciidoc[]
 include::rule-details/suspicious-network-activity-to-the-internet-by-previously-unknown-executable.asciidoc[]
 include::rule-details/suspicious-network-connection-via-systemd.asciidoc[]
 include::rule-details/suspicious-network-tool-launched-inside-a-container.asciidoc[]
@@ -1123,6 +1157,7 @@ include::rule-details/suspicious-outlook-child-process.asciidoc[]
 include::rule-details/suspicious-pdf-reader-child-process.asciidoc[]
 include::rule-details/suspicious-passwd-file-event-action.asciidoc[]
 include::rule-details/suspicious-path-invocation-from-command-line.asciidoc[]
+include::rule-details/suspicious-path-mounted.asciidoc[]
 include::rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc[]
 include::rule-details/suspicious-powershell-engine-imageload.asciidoc[]
 include::rule-details/suspicious-powershell-script.asciidoc[]
@@ -1166,6 +1201,7 @@ include::rule-details/svchost-spawning-cmd.asciidoc[]
 include::rule-details/symbolic-link-to-shadow-copy-created.asciidoc[]
 include::rule-details/system-binary-moved-or-copied.asciidoc[]
 include::rule-details/system-binary-path-file-permission-modification.asciidoc[]
+include::rule-details/system-binary-symlink-to-suspicious-location.asciidoc[]
 include::rule-details/system-hosts-file-access.asciidoc[]
 include::rule-details/system-information-discovery-via-windows-command-shell.asciidoc[]
 include::rule-details/system-log-file-deletion.asciidoc[]
@@ -1233,7 +1269,9 @@ include::rule-details/unusual-discovery-activity-by-user.asciidoc[]
 include::rule-details/unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc[]
 include::rule-details/unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc[]
 include::rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc[]
+include::rule-details/unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc[]
 include::rule-details/unusual-execution-via-microsoft-common-console-file.asciidoc[]
+include::rule-details/unusual-exim4-child-process.asciidoc[]
 include::rule-details/unusual-file-creation-alternate-data-stream.asciidoc[]
 include::rule-details/unusual-file-creation-by-web-server.asciidoc[]
 include::rule-details/unusual-file-modification-by-dns-exe.asciidoc[]
@@ -1246,6 +1284,7 @@ include::rule-details/unusual-hour-for-a-user-to-logon.asciidoc[]
 include::rule-details/unusual-instance-metadata-service-imds-api-request.asciidoc[]
 include::rule-details/unusual-interactive-process-launched-in-a-container.asciidoc[]
 include::rule-details/unusual-interactive-shell-launched-from-system-user.asciidoc[]
+include::rule-details/unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc[]
 include::rule-details/unusual-linux-network-activity.asciidoc[]
 include::rule-details/unusual-linux-network-configuration-discovery.asciidoc[]
 include::rule-details/unusual-linux-network-connection-discovery.asciidoc[]
@@ -1342,6 +1381,7 @@ include::rule-details/windows-firewall-disabled-via-powershell.asciidoc[]
 include::rule-details/windows-installer-with-suspicious-properties.asciidoc[]
 include::rule-details/windows-network-enumeration.asciidoc[]
 include::rule-details/windows-registry-file-creation-in-smb-share.asciidoc[]
+include::rule-details/windows-sandbox-with-sensitive-configuration.asciidoc[]
 include::rule-details/windows-script-executing-powershell.asciidoc[]
 include::rule-details/windows-script-interpreter-executing-process-via-wmi.asciidoc[]
 include::rule-details/windows-service-installed-via-an-unusual-client.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-establish-vscode-remote-tunnel.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-establish-vscode-remote-tunnel.asciidoc
index d2cf8c0457..13d22f6a5a 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-establish-vscode-remote-tunnel.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-establish-vscode-remote-tunnel.asciidoc
@@ -46,7 +46,7 @@ Detects the execution of the VScode portable binary with the tunnel command line
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
@@ -122,6 +122,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc
new file mode 100644
index 0000000000..0fd00fc7da
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc
@@ -0,0 +1,148 @@
+[[aws-s3-static-site-javascript-file-uploaded]]
+=== AWS S3 Static Site JavaScript File Uploaded
+
+This rule detects when a JavaScript file is uploaded or accessed in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/
+* https://docs.aws.amazon.com/AmazonS3/latest/userguide/WebsiteHosting.html
+* https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS S3
+* Tactic: Impact
+* Use Case: Web Application Compromise
+* Use Case: Cloud Threat Detection
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS S3 Static Site JavaScript File Uploaded*
+
+
+An S3 `PutObject` action that targets a path like `static/js/` and uploads a `.js` file is a potential signal for web content modification. If done by an unexpected IAM user or outside of CI/CD workflows, it may indicate a compromise.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Source User**: Check `aws.cloudtrail.user_identity.arn`, access key ID, and session type (`IAMUser`, `AssumedRole`, etc).
+- **Review File Content**: Use the S3 `GetObject` or CloudTrail `requestParameters` to inspect the uploaded file for signs of obfuscation or injection.
+- **Correlate to Other Events**: Review events from the same IAM user before and after the upload (e.g., `ListBuckets`, `GetCallerIdentity`, IAM activity).
+- **Look for Multiple Uploads**: Attackers may attempt to upload several files or modify multiple directories.
+
+
+*False Positive Analysis*
+
+
+- This behavior may be expected during app deployments. Look at:
+  - The `user_agent.original` to detect legitimate CI tools (like Terraform or GitHub Actions).
+  - Timing patterns—does this match a regular release window?
+  - The origin IP and device identity.
+
+
+*Response and Remediation*
+
+
+- **Revert Malicious Code**: Replace the uploaded JS file with a clean version and invalidate CloudFront cache if applicable.
+- **Revoke Access**: If compromise is confirmed, revoke the IAM credentials and disable the user.
+- **Audit IAM Policies**: Ensure that only deployment users can modify static site buckets.
+- **Enable Bucket Versioning**: This can allow for quick rollback and historical review.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-aws.cloudtrail* metadata _id, _version, _index
+| where
+
+    // filter on CloudTrail logs for S3 PutObject actions
+    event.dataset == "aws.cloudtrail"
+    and event.provider == "s3.amazonaws.com"
+    and event.action in ("GetObject","PutObject")
+
+    // filter for IAM users, not federated identities
+    and aws.cloudtrail.user_identity.type in ("IAMUser", "AssumedRole")
+
+    // filter for S3 static site bucket paths from webpack or similar
+    and aws.cloudtrail.request_parameters LIKE "*static/js/*.js*"
+
+    // exclude common IaC tools and automation scripts
+    and not (
+        user_agent.original LIKE "*Terraform*"
+        or user_agent.original LIKE "*Ansible*"
+        or user_agent.original LIKE "*Pulumni*"
+    )
+
+// extract bucket and object details from request parameters
+| dissect aws.cloudtrail.request_parameters "%{{?bucket.name.key}=%{bucket.name}, %{?host.key}=%{bucket.host}, %{?bucket.object.location.key}=%{bucket.object.location}}"
+
+// filter for specific bucket and object structure
+| dissect bucket.object.location "%{}static/js/%{bucket.object}"
+
+// filter for JavaScript files
+| where ENDS_WITH(bucket.object, ".js")
+| keep
+    aws.cloudtrail.user_identity.arn,
+    aws.cloudtrail.user_identity.access_key_id,
+    aws.cloudtrail.user_identity.type,
+    aws.cloudtrail.request_parameters,
+    bucket.name,
+    bucket.object,
+    user_agent.original,
+    source.ip,
+    event.action,
+    @timestamp
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Manipulation
+** ID: T1565
+** Reference URL: https://attack.mitre.org/techniques/T1565/
+* Sub-technique:
+** Name: Stored Data Manipulation
+** ID: T1565.001
+** Reference URL: https://attack.mitre.org/techniques/T1565/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
index e6bacedee9..e0d7071182 100644
--- a/docs/detections/prebuilt-rules/rule-details/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/azure-entra-sign-in-brute-force-against-microsoft-365-accounts.asciidoc
@@ -34,7 +34,7 @@ Identifies potential brute-force attempts against Microsoft 365 user accounts by
 * Tactic: Credential Access
 * Resources: Investigation Guide
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -108,6 +108,9 @@ from logs-azure.signinlogs*
   and to_lower(azure.signinlogs.properties.resource_display_name) rlike "(.*)365(.*)"
   and azure.signinlogs.category in ("NonInteractiveUserSignInLogs", "SignInLogs")
   and event.outcome != "success"
+  and not (azure.signinlogs.category == "NonInteractiveUserSignInLogs"
+      and azure.signinlogs.properties.status.error_code in (70043, 70044, 50057)
+      and azure.signinlogs.properties.incoming_token_type in ("primaryRefreshToken", "refreshToken")) 
   // for tuning review azure.signinlogs.properties.status.error_code
   // https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes
 
diff --git a/docs/detections/prebuilt-rules/rule-details/browser-extension-install.asciidoc b/docs/detections/prebuilt-rules/rule-details/browser-extension-install.asciidoc
index 6992ba7c2a..2a413be658 100644
--- a/docs/detections/prebuilt-rules/rule-details/browser-extension-install.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/browser-extension-install.asciidoc
@@ -39,7 +39,7 @@ Identifies the install of browser extensions. Malicious browser extensions can b
 * Data Source: Microsoft Defender for Endpoint
 * Resources: Investigation Guide
 
-*Version*: 205
+*Version*: 206
 
 *Rule authors*: 
 
@@ -129,6 +129,6 @@ file where host.os.type == "windows" and event.type : "creation" and
 ** ID: TA0003
 ** Reference URL: https://attack.mitre.org/tactics/TA0003/
 * Technique:
-** Name: Browser Extensions
+** Name: Software Extensions
 ** ID: T1176
 ** Reference URL: https://attack.mitre.org/techniques/T1176/
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 4a2528ccc3..16500326a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -33,7 +33,7 @@ Adversaries may implement command and control (C2) communications that use commo
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 119
+*Version*: 120
 
 *Rule authors*: 
 
@@ -199,7 +199,8 @@ network where host.os.type == "windows" and network.protocol == "dns" and
         "www.googleapis.com", 
         "googleapis.com",
         "global.rel.tunnels.api.visualstudio.com",
-        "*.devtunnels.ms") and
+        "*.devtunnels.ms", 
+        "api.github.com") and
         
     /* Insert noisy false positives here */
     not (
@@ -207,6 +208,7 @@ network where host.os.type == "windows" and network.protocol == "dns" and
         process.executable : (
           "?:\\Program Files\\*.exe",
           "?:\\Program Files (x86)\\*.exe",
+          "?:\\Windows\\system32\\svchost.exe",
           "?:\\Windows\\System32\\WWAHost.exe",
           "?:\\Windows\\System32\\smartscreen.exe",
           "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
@@ -218,8 +220,11 @@ network where host.os.type == "windows" and network.protocol == "dns" and
           "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
           "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
+          "?:\\Users\\*\\AppData\\Local\\PowerToys\\PowerToys.exe",
           "?:\\Windows\\system32\\mobsync.exe",
-          "?:\\Windows\\SysWOW64\\mobsync.exe"
+          "?:\\Windows\\SysWOW64\\mobsync.exe", 
+          "?:\\Windows\\System32\\wsl.exe", 
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe"
         )
       ) or
     
@@ -263,7 +268,10 @@ network where host.os.type == "windows" and network.protocol == "dns" and
                               "Slack Technologies, LLC",
                               "Cisco Systems, Inc.",
                               "Dropbox, Inc",
-                              "Amazon.com Services LLC"))
+                              "Amazon.com Services LLC", 
+                              "Island Technology Inc.", 
+                              "GitHub, Inc.", 
+                              "Red Hat, Inc"))
     )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
index a73b095d5e..9b025ce676 100644
--- a/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/default-cobalt-strike-team-server-certificate.asciidoc
@@ -12,9 +12,9 @@ This rule detects the use of the default Cobalt Strike Team Server TLS certifica
 * filebeat-*
 * logs-network_traffic.*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 5m
 
@@ -39,7 +39,7 @@ This rule detects the use of the default Cobalt Strike Team Server TLS certifica
 * Domain: Endpoint
 * Resources: Investigation Guide
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/docker-release-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/docker-release-file-creation.asciidoc
new file mode 100644
index 0000000000..b683338809
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/docker-release-file-creation.asciidoc
@@ -0,0 +1,62 @@
+[[docker-release-file-creation]]
+=== Docker Release File Creation
+
+This rule detects the creation of files named release_agent or notify_on_release, which are commonly associated with the abuse of Linux cgroup release mechanisms. In Docker or containerized environments, this behavior may indicate an attempt to exploit privilege escalation vulnerabilities such as CVE-2022-0492, where attackers use the release_agent feature to execute code on the host from within a container.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://sysdig.com/blog/detecting-mitigating-cve-2022-0492-sysdig/
+
+*Tags*: 
+
+* Domain: Endpoint
+* Domain: Container
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and file.name in ("release_agent", "notify_on_release")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Escape to Host
+** ID: T1611
+** Reference URL: https://attack.mitre.org/techniques/T1611/
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index 1e7baab820..edc72bba38 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -46,7 +46,7 @@ Identifies process execution from suspicious default Windows directories. This m
 * Data Source: Sysmon
 * Data Source: SentinelOne
 
-*Version*: 318
+*Version*: 319
 
 *Rule authors*: 
 
@@ -258,6 +258,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
index 1945daa02e..c7784a1684 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -42,7 +42,7 @@ Adversaries may install legitimate remote access tools (RAT) to compromised endp
 * Data Source: Windows Security Event Logs
 * Data Source: Sysmon
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
@@ -308,6 +308,6 @@ host.os.type: "windows" and
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/git-repository-or-file-download-to-suspicious-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/git-repository-or-file-download-to-suspicious-directory.asciidoc
new file mode 100644
index 0000000000..9f4c57b13e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/git-repository-or-file-download-to-suspicious-directory.asciidoc
@@ -0,0 +1,114 @@
+[[git-repository-or-file-download-to-suspicious-directory]]
+=== Git Repository or File Download to Suspicious Directory
+
+This rule detects the use of git to clone a repository or download files from GitHub using wget or curl, followed by the creation of files in suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior may indicate an attempt to download a payload, exploit or tool.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id, host.id with maxspan=10s
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
+     (process.name == "git" and process.args == "clone") or
+     (process.name in ("wget", "curl") and process.command_line like~ "*github*")
+  )]
+  [file where host.os.type == "linux" and event.type == "creation" and file.path like ("/tmp/*", "/var/tmp/*", "/dev/shm/*")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-telegram-api-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-telegram-api-request.asciidoc
new file mode 100644
index 0000000000..2738d9caf2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/linux-telegram-api-request.asciidoc
@@ -0,0 +1,114 @@
+[[linux-telegram-api-request]]
+=== Linux Telegram API Request
+
+This rule detects when a process executes the curl or wget command with an argument that includes the api.telegram.org domain. This may indicate command and control behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.name in ("curl", "wget") and process.command_line like "*api.telegram.org*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
index 012b6b1f2c..51c7ec61dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-dga-activity-using-a-known-sunburst-dns-domain.asciidoc
@@ -10,9 +10,9 @@ A supervised machine learning model has identified a DNS question name that used
 * logs-endpoint.events.*
 * logs-network_traffic.*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 5m
 
@@ -37,7 +37,7 @@ A supervised machine learning model has identified a DNS question name that used
 * Tactic: Command and Control
 * Resources: Investigation Guide
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/manual-memory-dumping-via-proc-filesystem.asciidoc b/docs/detections/prebuilt-rules/rule-details/manual-memory-dumping-via-proc-filesystem.asciidoc
new file mode 100644
index 0000000000..3de57c3f96
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/manual-memory-dumping-via-proc-filesystem.asciidoc
@@ -0,0 +1,112 @@
+[[manual-memory-dumping-via-proc-filesystem]]
+=== Manual Memory Dumping via Proc Filesystem
+
+This rule monitors for manual memory dumping via the proc filesystem. The proc filesystem in Linux provides a virtual filesystem that contains information about system processes and their memory mappings. Attackers may use this technique to dump the memory of a process, potentially extracting sensitive information such as credentials or encryption keys.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Data Source: Elastic Endgame
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.command_line like "/proc/*/mem"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Proc Filesystem
+** ID: T1003.007
+** Reference URL: https://attack.mitre.org/techniques/T1003/007/
+* Technique:
+** Name: Exploitation for Credential Access
+** ID: T1212
+** Reference URL: https://attack.mitre.org/techniques/T1212/
diff --git a/docs/detections/prebuilt-rules/rule-details/manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc b/docs/detections/prebuilt-rules/rule-details/manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
new file mode 100644
index 0000000000..5c1b9a7c9b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/manual-mount-discovery-via-etc-exports-or-etc-fstab.asciidoc
@@ -0,0 +1,103 @@
+[[manual-mount-discovery-via-etc-exports-or-etc-fstab]]
+=== Manual Mount Discovery via /etc/exports or /etc/fstab
+
+This rule detects manual mount discovery via the /etc/exports or /etc/fstab file on Linux systems. These files are used by NFS (Network File System) to define which directories are shared with remote hosts. Attackers may access this file to gather information about shared directories and potential targets for further exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.command_line like ("/etc/exports", "/etc/fstab")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
new file mode 100644
index 0000000000..bb3a66ce05
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -0,0 +1,137 @@
+[[microsoft-365-oauth-phishing-via-visual-studio-code-client]]
+=== Microsoft 365 OAuth Phishing via Visual Studio Code Client
+
+Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 OAuth Phishing via Visual Studio Code Client*
+
+
+This rule identifies successful Microsoft 365 sign-ins where the Visual Studio Code first-party application (`ApplicationId = aebc6443-996d-45c2-90f0-388ff96faa56`) was used to initiate an OAuth 2.0 authorization code flow targeting Microsoft Graph. While this is common for legitimate development workflows, it has been abused in real-world phishing campaigns to trick users into returning authorization codes that attackers can exchange for access tokens.
+
+The behavior is typically seen in targeted attacks where users are lured into clicking a Microsoft login URL that redirects to a legitimate Microsoft URI (such as `insiders.vscode.dev`) and displays an OAuth code. If the user returns this code (e.g., via Signal, WhatsApp, or email), the attacker can use it to gain access to the user’s data via Microsoft Graph APIs — all without prompting for explicit consent or MFA, especially when default or pre-consented apps are abused.
+
+
+*Possible investigation steps*
+
+
+- Review `user.name` or `o365.audit.UserId` to identify the impacted account.
+- Validate whether the user expected to authorize the Visual Studio Code app at the time of the event.
+- Check if `o365.audit.ActorIpAddress` is an unexpected or geolocated IP — especially outside of corporate ranges or from proxy networks.
+- Look at `user_agent.original` and `o365.audit.DeviceProperties` to determine the device and browser involved — known attacker flows often show Chrome + MacOS or headless browser variants.
+- Confirm the `Target.ID` (Microsoft Graph: `00000003-0000-0000-c000-000000000000`) matches the scope of access the attacker might attempt.
+- Check for follow-up access events or mailbox enumeration using the Graph API from unfamiliar service principals or devices.
+- Review the `ExtendedProperties.RequestType` = `OAuth2:Authorize` and `ResultStatusDetail` = `Redirect` — this indicates that the user was redirected after authorization, which typically exposes the OAuth `code`.
+
+
+*False positive analysis*
+
+
+- Developers or IT users intentionally using Visual Studio Code to connect to Microsoft 365 may trigger this rule.
+- Legitimate Visual Studio Code extensions that sync or query Graph API data (e.g., calendars, tasks, cloud-hosted notebooks).
+- Enterprise use cases where VS Code is used for integrated identity workflows.
+- Exclude known user agents and hosts that regularly use Visual Studio Code against Graph.
+- Whitelist specific source IPs or devices tied to developer machines.
+- Correlate with user context and behavior — if the user has no reason to be developing or testing code, the event may be more suspicious.
+- Add exception rules for managed devices or corporate laptops using this flow regularly.
+
+
+*Response and remediation*
+
+
+- Reach out to the user to confirm if they expected this login or may have shared an OAuth code.
+- Suspend or reset credentials if the login appears suspicious or if the code was likely returned to a third party.
+- Review recent Microsoft Graph activity (email, file access, Teams) for this user and service principal.
+- Block or restrict future use of OAuth tokens from unknown apps or IPs via Conditional Access.
+- Add alerts for `ApplicationId = aebc6443-...` combined with low-reputation IPs or unexpected device fingerprints.
+- Require MFA and Conditional Access for all OAuth flows — even for Microsoft first-party apps.
+- Disable or restrict app consent for users, and require admin approval for Graph API scopes.
+- Educate users about OAuth-based phishing techniques — especially those that ask users to share "codes" after clicking a Microsoft login link.
+- Regularly audit `ApplicationId`, `RequestType`, and `ResultStatusDetail` values in `o365.audit` to spot anomalous usage patterns.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "o365.audit"
+    and event.action: "UserLoggedIn"
+    and o365.audit.ApplicationId: "aebc6443-996d-45c2-90f0-388ff96faa56"
+    and o365.audit.Target.ID: "00000003-0000-0000-c000-000000000000"
+    and o365.audit.ExtendedProperties.RequestType: "OAuth2:Authorize"
+    and o365.audit.ExtendedProperties.ResultStatusDetail: "Redirect"
+    and o365.audit.UserType: ("0" or "2" or "3" or "5" or "6" or "10")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
new file mode 100644
index 0000000000..84f74f9253
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-redirect-to-device-registration-for-user-principal.asciidoc
@@ -0,0 +1,121 @@
+[[microsoft-365-oauth-redirect-to-device-registration-for-user-principal]]
+=== Microsoft 365 OAuth Redirect to Device Registration for User Principal
+
+Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-o365.audit-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 OAuth Redirect to Device Registration for User Principal*
+
+
+
+*Possible investigation steps*
+
+- Review the two UserLoggedIn logs to confirm that they come from different source.ip values and are associated to the same account.
+- Verify all events associated to the source.ip of the the second event in the sequence.
+- Investiguate the details of the new device that was added by reviewing the o365.audit.ModifiedProperties.Device_DisplayName.NewValue attribute.
+- Investigate the user account associated with the successful sign-in to determine if this activity aligns with expected behavior or if it appears suspicious.
+- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
+- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
+
+
+*False positive analysis*
+
+- Both authentcation events of the sequence are originatng from the same source.ip.
+- User using multiple devices and attempted to add a new device post an OAuth code authentication.
+
+
+*Response and remediation*
+
+- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
+- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
+- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
+- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
+- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
+- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
+- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by related.user with maxspan=30m
+[authentication where event.action == "UserLoggedIn" and
+ o365.audit.ExtendedProperties.RequestType == "OAuth2:Authorize" and o365.audit.ExtendedProperties.ResultStatusDetail == "Redirect" and
+ o365.audit.UserType: ("0", "2", "3", "10")] // victim source.ip
+[authentication where event.action == "UserLoggedIn" and
+ o365.audit.ExtendedProperties.RequestType == "OAuth2:Token" and o365.audit.ExtendedProperties.ResultStatusDetail == "Success"] // attacker source.ip to convert oauth code to token
+[web where event.dataset == "o365.audit" and event.action == "Add registered users to device."] // user.name is captured in related.user
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Device Registration
+** ID: T1098.005
+** Reference URL: https://attack.mitre.org/techniques/T1098/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
new file mode 100644
index 0000000000..d9187828d3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-azure-or-mail-sign-in-from-a-suspicious-source.asciidoc
@@ -0,0 +1,128 @@
+[[microsoft-azure-or-mail-sign-in-from-a-suspicious-source]]
+=== Microsoft Azure or Mail Sign-in from a Suspicious Source
+
+This rule correlate Azure or Office 356 mail successful sign-in events with network security alerts by source.ip. Adversaries may trigger some network security alerts such as reputation or other anomalies before accessing cloud resources.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in Logs
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Rule Type: Higher-Order Rule
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Azure or Mail Sign-in from a Suspicious Source*
+
+
+
+*Possible investigation steps*
+
+
+- Investiguate all the alerts associated with the source.ip.
+  - Verify the network security alert details associated with this source.ip.
+  - Verify all sign-in events associated with this source.ip.
+  - Consider the source IP address and geolocation for the involved user account.
+  - Consider the device used to sign in. Is it registered and compliant?
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+==== Setup
+
+
+The Azure Fleet integration, Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-*, .alerts-security.*
+// query runs every 1 hour looking for activities occured during last 8 hours to match on disparate events
+| where @timestamp > NOW() - 8 hours
+// filter for Azure or M365 sign-in and External Alerts with source.ip not null
+| where TO_IP(source.ip) is not null and (event.dataset in ("o365.audit", "azure.signinlogs") or kibana.alert.rule.name == "External Alerts") and
+// exclude private IP ranges
+  not CIDR_MATCH(TO_IP(source.ip), "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24", "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1","FE80::/10", "FF00::/8")
+| keep source.ip, event.action, event.outcome, event.dataset, kibana.alert.rule.name, event.category
+// split alerts to 3 buckets -  M365 mail access, azure sign-in and network related external alerts like NGFW and IDS
+| eval mail_access_src_ip = case(event.dataset == "o365.audit" and event.action == "MailItemsAccessed" and event.outcome == "success", TO_IP(source.ip), null),
+  azure_src_ip = case(event.dataset == "azure.signinlogs" and event.outcome == "success", TO_IP(source.ip), null),
+  network_alert_src_ip = case(kibana.alert.rule.name == "External Alerts" and not event.dataset in ("o365.audit", "azure.signinlogs"), TO_IP(source.ip), null)
+// aggregated alerts count by bucket and by source.ip
+| stats total_alerts = count(*), is_mail_access = COUNT_DISTINCT(mail_access_src_ip), is_azure = COUNT_DISTINCT(azure_src_ip), unique_dataset = COUNT_DISTINCT(event.dataset),is_network_alert = COUNT_DISTINCT(network_alert_src_ip), datasets = VALUES(event.dataset), rules = VALUES(kibana.alert.rule.name), cat = VALUES(event.category) by source_ip = TO_IP(source.ip)
+// filter for cases where there is a successful sign-in to azure or m365 mail and the source.ip is reported by a network external alert.
+| where is_network_alert  > 0 and (is_mail_access > 0 or is_azure > 0 and unique_dataset >= 2)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index d03b8b3b43..f9ea6d7792 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -38,7 +38,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -133,7 +133,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
new file mode 100644
index 0000000000..390002711d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties.asciidoc
@@ -0,0 +1,121 @@
+[[microsoft-entra-id-concurrent-sign-ins-with-suspicious-properties]]
+=== Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties
+
+Identifies concurrent azure signin events for the same user and from multiple sources, and where one of the authentication event has some suspicious properties often associated to DeviceCode and OAuth phishing. Adversaries may steal Refresh Tokens (RTs) via phishing to bypass multi-factor authentication (MFA) and gain unauthorized access to Azure resources.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/entra/identity/
+* https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Concurrent Sign-Ins with Suspicious Properties*
+
+
+
+*Possible investigation steps*
+
+
+- Review the sign-in logs to assess the context and reputation of the source.ip address.
+- Investigate the user account associated with the successful sign-in to determine if the activity aligns with expected behavior or if it appears suspicious.
+- Check for any recent changes or anomalies in the user's account settings or permissions that could indicate compromise.
+- Review the history of sign-ins for the user to identify any patterns or unusual access times that could suggest unauthorized access.
+- Assess the device from which the sign-in was attempted to ensure it is a recognized and authorized device for the user.
+
+
+*Response and remediation*
+
+
+- Immediately revoke the compromised Primary Refresh Tokens (PRTs) to prevent further unauthorized access. This can be done through the Azure portal by navigating to the user's account and invalidating all active sessions.
+- Enforce a password reset for the affected user accounts to ensure that any credentials potentially compromised during the attack are no longer valid.
+- Implement additional Conditional Access policies that require device compliance checks and restrict access to trusted locations or devices only, to mitigate the risk of future PRT abuse.
+- Conduct a thorough review of the affected accounts' recent activity logs to identify any unauthorized actions or data access that may have occurred during the compromise.
+- Escalate the incident to the security operations team for further investigation and to determine if there are any broader implications or additional compromised accounts.
+- Enhance monitoring by configuring alerts for unusual sign-in patterns or device code authentication attempts from unexpected locations or devices, to improve early detection of similar threats.
+- Coordinate with the incident response team to perform a post-incident analysis and update the incident response plan with lessons learned from this event.
+
+==== Setup
+
+
+
+*Required Azure Entra Sign-In Logs*
+
+This rule requires the Azure logs integration be enabled and configured to collect all logs, including sign-in logs from Entra. In Entra, sign-in logs must be enabled and streaming to the Event Hub used for the Azure logs integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-azure.signinlogs* metadata _id, _version, _index
+// the rule is scheduled to run every hour and looks for events occured during last 1 hour.
+| where @timestamp > NOW() - 1 hours
+| where event.dataset == "azure.signinlogs" and source.ip is not null and azure.signinlogs.identity is not null and to_lower(event.outcome) == "success"
+| keep @timestamp, azure.signinlogs.identity, source.ip, azure.signinlogs.properties.authentication_requirement, azure.signinlogs.properties.app_id, azure.signinlogs.properties.resource_display_name, azure.signinlogs.properties.authentication_protocol, azure.signinlogs.properties.app_display_name
+// devicecode authentication no MFA
+| eval device_code = case(azure.signinlogs.properties.authentication_protocol == "deviceCode" and azure.signinlogs.properties.authentication_requirement != "multiFactorAuthentication", azure.signinlogs.identity, null),
+// potential Visual Studio Code OAuth code phish - sign-in events with client set to Visual Studio Code
+ visual_studio = case(azure.signinlogs.properties.app_id == "aebc6443-996d-45c2-90f0-388ff96faa56" and azure.signinlogs.properties.resource_display_name == "Microsoft Graph", azure.signinlogs.identity, null),
+// Other sign-in events
+ other = case(azure.signinlogs.properties.authentication_protocol != "deviceCode" and azure.signinlogs.properties.app_id != "aebc6443-996d-45c2-90f0-388ff96faa56", azure.signinlogs.identity, null)
+| stats total = COUNT(*), device_code_count = COUNT_DISTINCT(device_code), vsc = count_distinct(visual_studio), other_count = COUNT_DISTINCT(other), src_ip = COUNT_DISTINCT(source.ip), ips = values(source.ip), clients = values(azure.signinlogs.properties.app_display_name), resources = VALUES(azure.signinlogs.properties.resource_display_name), auth_requirement = VALUES(azure.signinlogs.properties.authentication_requirement) by azure.signinlogs.identity
+// 2 unique source.ip for same account - which may indicate the presence 2 sign-ins one by the adversary and the other by the victim
+| where src_ip >= 2 and (device_code_count > 0 or vsc >0)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
new file mode 100644
index 0000000000..23cb718764
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -0,0 +1,138 @@
+[[microsoft-entra-id-oauth-phishing-via-visual-studio-code-client]]
+=== Microsoft Entra ID OAuth Phishing via Visual Studio Code Client
+
+Detects potentially suspicious OAuth authorization activity in Microsoft Entra ID where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode's Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.signinlogs-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Sign-in Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID OAuth Phishing via Visual Studio Code Client*
+
+
+
+*Possible investigation steps*
+
+
+- Identify the source IP address from which the failed login attempts originated by reviewing `source.ip`. Determine if the IP is associated with known malicious activity using threat intelligence sources or if it belongs to a corporate VPN, proxy, or automation process.
+- Analyze affected user accounts by reviewing `azure.signinlogs.properties.user_principal_name` to determine if they belong to privileged roles or high-value users. Look for patterns indicating multiple failed attempts across different users, which could suggest a password spraying attempt.
+- Examine the authentication method used in `azure.signinlogs.properties.authentication_details` to identify which authentication protocols were attempted and why they failed. Legacy authentication methods may be more susceptible to brute-force attacks.
+- Review the authentication error codes found in `azure.signinlogs.properties.status.error_code` to understand why the login attempts failed. Common errors include `50126` for invalid credentials, `50053` for account lockouts, `50055` for expired passwords, and `50056` for users without a password.
+- Correlate failed logins with other sign-in activity by looking at `event.outcome`. Identify if there were any successful logins from the same user shortly after multiple failures or if there are different geolocations or device fingerprints associated with the same account.
+- Review `azure.signinlogs.properties.app_id` to identify which applications were initiating the authentication attempts. Determine if these applications are Microsoft-owned, third-party, or custom applications and if they are authorized to access the resources.
+- Check for any conditional access policies that may have been triggered by the failed login attempts by reviewing `azure.signinlogs.properties.authentication_requirement`. This can help identify if the failed attempts were due to policy enforcement or misconfiguration.
+
+
+*False positive analysis*
+
+
+- Automated scripts or applications using non-interactive authentication may trigger this detection, particularly if they rely on legacy authentication protocols recorded in `azure.signinlogs.properties.authentication_protocol`.
+- Corporate proxies or VPNs may cause multiple users to authenticate from the same IP, appearing as repeated failed attempts under `source.ip`.
+- User account lockouts from forgotten passwords or misconfigured applications may show multiple authentication failures in `azure.signinlogs.properties.status.error_code`.
+- Exclude known trusted IPs, such as corporate infrastructure, from alerts by filtering `source.ip`.
+- Exlcude known custom applications from `azure.signinlogs.properties.app_id` that are authorized to use non-interactive authentication.
+- Ignore principals with a history of failed logins due to legitimate reasons, such as expired passwords or account lockouts, by filtering `azure.signinlogs.properties.user_principal_name`.
+- Correlate sign-in failures with password reset events or normal user behavior before triggering an alert.
+
+
+*Response and remediation*
+
+
+- Block the source IP address in `source.ip` if determined to be malicious.
+- Reset passwords for all affected user accounts listed in `azure.signinlogs.properties.user_principal_name` and enforce stronger password policies.
+- Ensure basic authentication is disabled for all applications using legacy authentication protocols listed in `azure.signinlogs.properties.authentication_protocol`.
+- Enable multi-factor authentication (MFA) for impacted accounts to mitigate credential-based attacks.
+- Review conditional access policies to ensure they are correctly configured to block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
+- Review Conditional Access policies to enforce risk-based authentication and block unauthorized access attempts recorded in `azure.signinlogs.properties.authentication_requirement`.
+- Implement a zero-trust security model by enforcing least privilege access and continuous authentication.
+- Regularly review and update conditional access policies to ensure they are effective against evolving threats.
+- Restrict the use of legacy authentication protocols by disabling authentication methods listed in `azure.signinlogs.properties.client_app_used`.
+- Regularly audit authentication logs in `azure.signinlogs` to detect abnormal login behavior and ensure early detection of potential attacks.
+- Regularly rotate client credentials and secrets for applications using non-interactive authentication to reduce the risk of credential theft.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.signinlogs" and
+event.action: "Sign-in activity" and
+event.outcome: "success" and
+(
+  azure.signinlogs.properties.resource_display_name: "Microsoft Graph" or
+  azure.signinlogs.properties.resource_id: "00000003-0000-0000-c000-000000000000"
+) and (
+  azure.signinlogs.properties.app_id: "aebc6443-996d-45c2-90f0-388ff96faa56" or
+  azure.signinlogs.properties.app_display_name: "Visual Studio Code"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
new file mode 100644
index 0000000000..a6b673d61c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-protection-anonymized-ip-risk-detection.asciidoc
@@ -0,0 +1,128 @@
+[[microsoft-entra-id-protection-anonymized-ip-risk-detection]]
+=== Microsoft Entra ID Protection Anonymized IP Risk Detection
+
+Identifies Microsoft Entra ID Protection risk detections triggered due to sign-in activity from anonymized IP addresses, which is often associated with Tor exit nodes, proxies, or anonymizing VPNs. This behavior may indicate evasion tactics or account compromise activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Entra ID
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Protection Anonymized IP Risk Detection*
+
+
+This rule identifies cases where Microsoft Entra ID (formerly Azure AD) detects sign-in activity from anonymized IP addresses,
+often triggered when a user connects via a Tor exit node, privacy VPN, or proxy service.
+
+
+*Possible Investigation Steps:*
+
+
+Review the following fields for context and threat validation:
+
+- `source.ip`: Investigate if the IP is tied to anonymizers (VPNs, proxies, Tor). Check threat intel feeds or proxy/firewall logs to assess reputation. Pivot on this IP to see if it appears in other Azure logs across users.
+- `source.geo.*`: Evaluate the geolocation (city, country, coordinates) of the sign-in. Compare this with known user locations or expected travel patterns.
+- `azure.identityprotection.properties.user_principal_name`: The affected user. Correlate with recent changes in login behavior, app access, or device registration. Review audit logs or recent sign-ins for anomalies.
+- `azure.identityprotection.properties.risk_event_type`: Confirms the type of detection (`anonymizedIPAddress`). Use this to correlate across similar risk types for the same or other users.
+- `azure.identityprotection.properties.additional_info`: This often includes the user agent used in the sign-in (`userAgent`). Investigate automation indicators such as `python-requests`, curl, or scripts.
+- `user_agent.original`: Identify if the user agent string is consistent with the user’s typical environment or tools. Look for anomalies suggesting programmatic access.
+- `azure.identityprotection.properties.risk_level`, `risk_detail`, and `risk_state`: Help gauge severity and whether automated remediation (like MFA enforcement) succeeded.
+- `@timestamp` and `event.ingested`: Validate when the detection occurred versus when it was ingested, which helps determine freshness and accuracy of the event.
+- `azure.signinlogs` for the same user or IP to confirm whether sign-ins occurred with that IP around the same time.
+- `azure.auditlogs` for recent changes to MFA settings, Conditional Access policies, or service principal activity.
+- Identity Protection logs for the same risk type across users to check if this is isolated or part of a larger campaign.
+
+
+*False Positive Analysis*
+
+
+- Anonymized access may occur in environments where privacy tools are permitted (e.g., journalists, remote contractors).
+- Developers or testers using automation from cloud IPs or headless clients may trigger this.
+- Risk state `remediated` might indicate policy-enforced MFA was effective—verify if it aligns with normal activity.
+
+
+*Response and Remediation*
+
+
+- If the sign-in is unauthorized, immediately reset the user’s password and revoke refresh tokens.
+- Notify the user and confirm whether the login was expected.
+- If legitimate, consider excluding specific known anonymized infrastructure from risk detection.
+- Review Conditional Access policies to enforce stricter controls on anonymized IP usage.
+- Monitor for additional risky sign-ins or device registration events tied to the user.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Protection Logs*
+
+To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.identity_protection"
+    and event.action: "User Risk Detection"
+    and azure.identityprotection.properties.risk_event_type: "anonymizedIPAddress"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Proxy
+** ID: T1090
+** Reference URL: https://attack.mitre.org/techniques/T1090/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-service-principal-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-service-principal-created.asciidoc
new file mode 100644
index 0000000000..fcbb49f6d4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-service-principal-created.asciidoc
@@ -0,0 +1,141 @@
+[[microsoft-entra-id-service-principal-created]]
+=== Microsoft Entra ID Service Principal Created
+
+Identifies when a new service principal is added in Microsoft Entra ID. An application, hosted service, or automated tool that accesses or modifies resources needs an identity created. This identity is known as a service principal. For security reasons, it's always recommended to use service principals with automated tools rather than allowing them to log in with a user identity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.auditlogs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
+* https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Service Principal Created*
+
+
+Service Principals are identities used by applications, services, and automation tools to access specific resources. They grant specific access based on the assigned API permissions. Most organizations that work a lot with Azure AD make use of service principals. Whenever an application is registered, it automatically creates an application object and a service principal in an Azure AD tenant.
+
+This rule looks for the addition of service principals. This behavior may enable attackers to impersonate legitimate service principals to camouflage their activities among noisy automations/apps.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Consider the source IP address and geolocation for the user who issued the command. Do they look normal for the user?
+- Consider the time of day. If the user is a human, not a program or script, did the activity take place during a normal time of day?
+- Check if this operation was approved and performed according to the organization's change management policy.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Examine the account's commands, API calls, and data management actions in the last 24 hours.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+
+If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Microsft Entra ID Audit Logs*
+
+This rule requires the Azure integration with Microsoft Entra ID Audit Logs data stream ingesting in your Elastic Stack deployment. For more information, refer to the https://www.elastic.co/docs/reference/integrations/azure/adlogs[Microsoft Entra ID Audit Logs integration documentation].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:azure.auditlogs
+    and azure.auditlogs.operation_name:"Add service principal"
+    and event.outcome:(success or Success)
+    and not azure.auditlogs.identity: (
+        "Managed Service Identity" or
+        "Windows Azure Service Management API" or
+        "Microsoft Azure AD Internal - Jit Provisioning" or
+        "AAD App Management" or
+        "Power Virtual Agents Service"
+        )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
new file mode 100644
index 0000000000..33a6d6dc7d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
@@ -0,0 +1,136 @@
+[[microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker]]
+=== Microsoft Entra ID SharePoint Access for User Principal via Auth Broker
+
+This rule detects non-interactive authentication activity against SharePoint Online (`Office 365 SharePoint Online`) by a user principal via the `Microsoft Authentication Broker` application. The session leverages a refresh token or Primary Refresh Token (PRT) without interactive sign-in, often used in OAuth phishing or token replay scenarios.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-azure.signinlogs-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Use Case: Identity and Access Audit
+* Tactic: Collection
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Sign-in Logs
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID SharePoint Access for User Principal via Auth Broker*
+
+
+This rule identifies non-interactive sign-ins to SharePoint Online via the Microsoft Authentication Broker application using a refresh token or Primary Refresh Token (PRT). This type of activity may indicate token replay attacks, OAuth abuse, or automated access from previously consented apps or stolen sessions.
+
+This is a https://www.elastic.co/guide/en/security/current/new-terms-rules.html[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
+
+
+*Possible Investigation Steps:*
+
+
+- `azure.signinlogs.properties.user_principal_name`: Identify the user involved. Investigate whether this user typically accesses SharePoint or if this is an anomaly.
+- `azure.signinlogs.properties.app_display_name`: Verify the application used (e.g., Authentication Broker). Determine if the app is expected for SharePoint access in your environment.
+- `azure.signinlogs.properties.resource_display_name`: Review the resource being accessed. SharePoint activity should be aligned with job roles or historical usage.
+- `azure.signinlogs.properties.incoming_token_type`: Indicates the token type used. Look for `refreshToken` or `primaryRefreshToken`, which may point to token replay or silent access.
+- `azure.signinlogs.properties.is_interactive`: If false, indicates the sign-in was non-interactive. Correlate with recent sign-ins to understand if a prior session may have been reused.
+- `user_agent.original`: Analyze the user agent string for automation indicators (e.g., scripts, unusual clients). Compare with what’s typical for the user or device.
+- `source.ip`: Check the originating IP address. Investigate if the IP is associated with data centers, VPNs, anonymizers, or is geographically unusual for the user.
+- `source.geo.*`: Evaluate sign-in location details. Determine if the sign-in location aligns with expected travel or usage behavior.
+- `azure.signinlogs.properties.applied_conditional_access_policies`: Review whether Conditional Access policies were triggered or bypassed. Investigate if required controls (like MFA) were applied.
+- `azure.signinlogs.properties.authentication_processing_details`: Review any details about the authentication, such as token type or scopes. This may indicate delegated access or automation patterns.
+
+
+*False Positive Analysis*
+
+
+- Certain MDM or mobile app scenarios may use refresh tokens legitimately via brokered apps.
+- Automated processes using authorized, scripted clients could trigger this activity, especially in developer or operations environments.
+- If Conditional Access policies are configured in “report-only” mode or exempted for trusted apps, activity may appear unusual but be authorized.
+
+
+*Response and Remediation*
+
+
+- If activity appears unauthorized:
+  - Investigate and revoke active sessions or refresh tokens.
+  - Notify the user and validate expected activity.
+  - Review and audit app consent permissions and remove unused or high-risk delegated access.
+- Harden Conditional Access policies to limit non-interactive access to sensitive resources.
+- Monitor for repeated use of the same user agent, IP, or token type across other users to identify broader campaigns.
+- Consider alerting on unusual patterns in sign-in frequency, geography, and application usage for SharePoint and other key services.
+
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Sign-In Logs*
+
+To use this rule, ensure that Microsoft Entra ID Sign-In Logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.signinlogs"
+    and azure.signinlogs.properties.app_id: "29d9ed98-a469-4536-ade2-f981bc1d605e"
+    and azure.signinlogs.properties.resource_id: "00000003-0000-0ff1-ce00-000000000000"
+    and azure.signinlogs.identity: *
+    and azure.signinlogs.properties.user_principal_name: *
+    and azure.signinlogs.properties.incoming_token_type: ("refreshToken" or "primaryRefreshToken")
+    and azure.signinlogs.properties.is_interactive: false
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Information Repositories
+** ID: T1213
+** Reference URL: https://attack.mitre.org/techniques/T1213/
+* Sub-technique:
+** Name: Sharepoint
+** ID: T1213.002
+** Reference URL: https://attack.mitre.org/techniques/T1213/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
new file mode 100644
index 0000000000..ee65b8d543
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
@@ -0,0 +1,123 @@
+[[microsoft-graph-first-occurrence-of-client-request]]
+=== Microsoft Graph First Occurrence of Client Request
+
+This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.graphactivitylogs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Graph
+* Data Source: Microsoft Graph Activity Logs
+* Resources: Investigation Guide
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Graph First Occurrence of Client Request*
+
+
+This rule detects the first observed occurrence of a Microsoft Graph API request by a specific client application ID (`azure.graphactivitylogs.properties.app_id`) in combination with a user principal object ID (`azure.graphactivitylogs.properties.user_principal_object_id`) and tenant ID (`azure.tenant_id`) within the last 14 days. This may indicate unauthorized access following a successful phishing attempt, token theft, or abuse of OAuth workflows.
+
+Adversaries frequently exploit legitimate Microsoft or third-party application IDs to avoid raising suspicion during initial access. By using pre-consented or trusted apps to interact with Microsoft Graph, attackers can perform actions on behalf of users without triggering conventional authentication alerts or requiring additional user interaction.
+
+
+*Possible investigation steps*
+
+
+- Review `azure.graphactivitylogs.properties.user_principal_object_id` and correlate with recent sign-in logs for the associated user.
+- Determine whether `azure.graphactivitylogs.properties.app_id` is a known and approved application in your environment.
+- Investigate the `user_agent.original` field for signs of scripted access (e.g., automation tools or libraries).
+- Check the source IP address (`source.ip`) and geolocation data (`source.geo.*`) for unfamiliar origins.
+- Inspect `azure.graphactivitylogs.properties.scopes` to understand the level of access being requested by the app.
+- Examine any follow-up Graph API activity from the same `app_id` or `user_principal_object_id` for signs of data access or exfiltration.
+- Correlate with device or session ID fields (`azure.graphactivitylogs.properties.c_sid`, if present) to detect persistent or repeat activity.
+
+
+*False positive analysis*
+
+
+- First-time use of a legitimate Microsoft or enterprise-approved application.
+- Developer or automation workflows initiating new Graph API requests.
+- Valid end-user activity following device reconfiguration or new client installation.
+- Maintain an allowlist of expected `app_id` values and known developer tools.
+- Suppress detections from known good `user_agent.original` strings or approved source IP ranges.
+- Use device and identity telemetry to distinguish trusted vs. unknown activity sources.
+- Combine with session risk or sign-in anomaly signals where available.
+
+
+*Response and remediation*
+
+
+- Reach out to the user and verify whether they authorized the application access.
+- Revoke active OAuth tokens and reset credentials if unauthorized use is confirmed.
+- Search for additional Graph API calls made by the same `app_id` or `user_principal_object_id`.
+- Investigate whether sensitive resources (mail, files, Teams, contacts) were accessed.
+- Apply Conditional Access policies to limit Graph API access by app type, IP, or device state.
+- Restrict user consent for third-party apps and enforce admin approval workflows.
+- Monitor usage of new or uncommon `app_id` values across your tenant.
+- Provide user education on OAuth phishing tactics and reporting suspicious prompts.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.graphactivitylogs"
+    and event.type: "access"
+    and azure.graphactivitylogs.properties.c_idtyp: "user"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
new file mode 100644
index 0000000000..c4ca9def76
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
@@ -0,0 +1,120 @@
+[[multiple-microsoft-entra-id-protection-alerts-by-user-principal]]
+=== Multiple Microsoft Entra ID Protection Alerts by User Principal
+
+Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Protection Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Multiple Microsoft Entra ID Protection Alerts by User Principal*
+
+
+
+*Possible investigation steps*
+
+- Identify the Risk Detection that triggered the event. A list with descriptions can be found https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection[here].
+- Identify the user account involved and validate whether the suspicious activity is normal for that user.
+  - Consider the source IP address and geolocation for the involved user account. Do they look normal?
+  - Consider the device used to sign in. Is it registered and compliant?
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
+- Consider the context of the user account and whether the activity is expected. For example, if the user is a developer or administrator, they may have legitimate reasons for accessing resources from various locations or devices.
+
+
+*Response and remediation*
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
+[any where event.module == "azure" and event.dataset == "azure.identity_protection"] with runs=2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-backdoor-execution-through-pam-exec.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-backdoor-execution-through-pam-exec.asciidoc
new file mode 100644
index 0000000000..6d877e0702
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-backdoor-execution-through-pam-exec.asciidoc
@@ -0,0 +1,80 @@
+[[potential-backdoor-execution-through-pam-exec]]
+=== Potential Backdoor Execution Through PAM_EXEC
+
+This rule detects SSH session ID change followed by a suspicious SSHD child process, this may indicate the successful execution of a potentially malicious process through the Pluggable Authentication Module (PAM) utility. PAM is a framework used by Linux systems to authenticate users. Adversaries may create malicious PAM modules that grant them persistence onto the target every time a user logs in by executing a backdoor script or command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/approaching-the-summit-on-persistence
+* https://www.group-ib.com/blog/pluggable-authentication-module/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=3s
+  [process where host.os.type == "linux" and event.type == "change" and event.action == "session_id_change" and process.name in ("ssh", "sshd")]
+  [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name in ("ssh", "sshd") and
+   process.args_count == 2 and (
+     process.name like ("perl*", "python*", "php*", "ruby*", "lua*") or
+     process.executable like (
+       "/tmp/*", "/var/tmp/*", "/dev/shm/*", "./*", "/boot/*", "/sys/*", "/lost+found/*", "/media/*", "/proc/*",
+       "/var/backups/*", "/var/log/*", "/var/mail/*", "/var/spool/*") or
+     process.name like ".*"
+   )]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-through-curl.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-through-curl.asciidoc
new file mode 100644
index 0000000000..6e74421fff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-through-curl.asciidoc
@@ -0,0 +1,114 @@
+[[potential-data-exfiltration-through-curl]]
+=== Potential Data Exfiltration Through Curl
+
+Detects the use of curl to upload an archived file to an internet server. Threat actors often will collect data on a system and compress it in an archive file before exfiltrating the file back to their C2 server for review. Many threat actors have been seen utilizing curl to upload this archive file with the collected data to do this. Use of curl in this way while not inherently malicious should be considered highly abnormal and suspicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://everything.curl.dev/usingcurl/uploads
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to “Security → Manage → Policies”.
+- Select an “Elastic Agent policy”.
+- Click “Show advanced settings”.
+- Scroll down or search for “linux.advanced.capture_env_vars”.
+- Enter the names of environment variables you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "HTTP_PROXY,HTTPS_PROXY,ALL_PROXY".
+- Click “Save”.
+After saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.
+For more information on capturing environment variables refer to the https://www.elastic.co/guide/en/security/current/environment-variable-capture.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "curl" and
+process.parent.executable != null and (process.args in ("-F", "-T", "-d") or process.args like "--data*") and 
+process.command_line like~ ("*@/*.zip*", "*@/*.gz*", "*@/*.tgz*", "*b64=@*", "*=<*") and
+process.command_line like~ "*http*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Alternative Protocol
+** ID: T1048
+** Reference URL: https://attack.mitre.org/techniques/T1048/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
new file mode 100644
index 0000000000..1cca604222
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dynamic-iex-reconstruction-via-environment-variables.asciidoc
@@ -0,0 +1,113 @@
+[[potential-dynamic-iex-reconstruction-via-environment-variables]]
+=== Potential Dynamic IEX Reconstruction via Environment Variables
+
+Identifies PowerShell scripts that reconstruct the IEX (Invoke-Expression) command at runtime using indexed slices of environment variables. This technique leverages character access and join operations to build execution logic dynamically, bypassing static keyword detection and evading defenses such as AMSI.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(?i)(\$(?:\w+|\w+\:\w+)\[\d++\]\+\$(?:\w+|\w+\:\w+)\[\d++\]\+['"]x['"]|\$(?:\w+\:\w+)\[\d++,\d++,\d++\]|\.name\[\d++,\d++,\d++\])""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-command-line.asciidoc
new file mode 100644
index 0000000000..2b89276fc5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-command-line.asciidoc
@@ -0,0 +1,124 @@
+[[potential-hex-payload-execution-via-command-line]]
+=== Potential Hex Payload Execution via Command-Line
+
+This rule detects when a process executes a command line containing hexadecimal characters. Malware authors may use hexadecimal encoding to obfuscate their payload and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.parent.executable != null and
+process.command_line : "*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*\\x*" and
+length(process.command_line) > 50
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-common-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-common-utility.asciidoc
new file mode 100644
index 0000000000..7c04fe3961
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-hex-payload-execution-via-common-utility.asciidoc
@@ -0,0 +1,186 @@
+[[potential-hex-payload-execution-via-common-utility]]
+=== Potential Hex Payload Execution via Common Utility
+
+This rule detects potential hex payload execution on Linux systems. Adversaries may use hex encoding to obfuscate payloads and evade detection mechanisms.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+* logs-crowdstrike.fdr*
+* logs-sentinel_one_cloud_funnel.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Potential Hex Payload Execution via Common Utility*
+
+
+Hex encoding is often used in Linux environments to obfuscate data, making it harder for security tools to detect malicious payloads. Adversaries exploit this by encoding their payloads in hex to bypass security measures. The detection rule identifies suspicious processes like `xxd`, `python`, `php`, and others that use hex-related functions, signaling potential obfuscation attempts. By monitoring these patterns, the rule helps uncover hidden threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details, including the process name and command line arguments, to confirm if the execution aligns with typical hex decoding or encoding activities.
+- Check the parent process of the suspicious process to understand the context of how the process was initiated and whether it was expected or part of a legitimate workflow.
+- Investigate the user account associated with the process execution to determine if the activity is consistent with the user's normal behavior or if the account may have been compromised.
+- Examine the network activity associated with the process to identify any potential data exfiltration or communication with known malicious IP addresses.
+- Look for any related file modifications or creations around the time of the process execution to identify if the decoded payload was written to disk or executed further.
+- Cross-reference the alert with other security tools or logs, such as Crowdstrike or SentinelOne, to gather additional context or corroborating evidence of malicious activity.
+
+
+*False positive analysis*
+
+
+- Development and testing environments may frequently use hex encoding functions for legitimate purposes. To reduce noise, consider excluding processes running on known development servers from the rule.
+- System administrators might use hex encoding tools like `xxd` for data conversion tasks. Identify and whitelist these routine administrative scripts to prevent false alerts.
+- Automated scripts or applications that process data in hex format for encoding or decoding purposes can trigger this rule. Review and exclude these scripts if they are verified as non-malicious.
+- Security tools or monitoring solutions themselves might use hex encoding for data analysis. Ensure these tools are recognized and excluded from triggering the rule.
+- Regularly review and update the exclusion list to adapt to changes in the environment and ensure that only verified non-threatening behaviors are excluded.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of potentially malicious payloads.
+- Terminate any suspicious processes identified by the detection rule, such as those involving `xxd`, `python`, `php`, `ruby`, `perl`, or `lua` with hex-related functions.
+- Conduct a thorough scan of the isolated system using updated antivirus and anti-malware tools to identify and remove any malicious payloads or remnants.
+- Review and analyze system logs and process execution history to determine the scope of the compromise and identify any additional affected systems.
+- Restore the system from a known good backup if malicious activity is confirmed and cannot be fully remediated.
+- Implement additional monitoring on the affected system and network to detect any recurrence of similar obfuscation attempts.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to assess the need for broader organizational response measures.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+  event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+  (
+    (process.name == "xxd" and process.args like ("-r*", "-p*")) or
+    (process.name like "python*" and process.command_line like "*fromhex*" and process.command_line like ("*decode*", "*encode*")) or
+    (process.name like "php*" and process.command_line like "*hex2bin*") or
+    (process.name like "ruby*" and process.command_line like "*].pack(\"H*\")*") or
+    (process.name like "perl*" and process.command_line like "*pack(\"H*\",*") or
+    (process.name like "lua*" and process.command_line like "*tonumber(cc, 16)*")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
new file mode 100644
index 0000000000..f0e016bd35
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-tunneling-and-or-port-forwarding-via-ssh-option.asciidoc
@@ -0,0 +1,110 @@
+[[potential-linux-tunneling-and-or-port-forwarding-via-ssh-option]]
+=== Potential Linux Tunneling and/or Port Forwarding via SSH Option
+
+This rule detects the use of SSH options that may indicate tunneling or port forwarding on Linux systems. This behavior is commonly associated with malicious activity, such as establishing a port forward, proxy or an encrypted tunnel to exfiltrate data.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform
+* https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("ssh", "sshd") and process.args == "-o" and
+process.command_line like~ (
+  "*ProxyCommand*", "*LocalForward*", "*RemoteForward*", "*DynamicForward*", "*Tunnel*", "*GatewayPorts*",
+  "*ExitOnForwardFailure*", "*ProxyCommand*", "*ProxyJump*"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
index 1ed0236048..a55ddd5d89 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-browser-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of browser processes, such as unsigned or signed
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
@@ -193,7 +193,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
index f061d8dfa8..1d2eb5ea55 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
@@ -34,7 +34,7 @@ Identifies executables with names resembling legitimate business applications bu
 * Tactic: Execution
 * Resources: Investigation Guide
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
@@ -243,7 +243,7 @@ process where host.os.type == "windows" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
index 2556a06ef0..1744774a0c 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
@@ -30,7 +30,7 @@ Identifies suspicious instances of communications apps, both unsigned and rename
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 9
+*Version*: 10
 
 *Rule authors*: 
 
@@ -171,7 +171,7 @@ process where host.os.type == "windows" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
index 3bcd93e1b7..8164966565 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-dll.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of default system32 DLLs either unsigned or sign
 * Tactic: Persistence
 * Rule Type: BBR
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -132,7 +132,7 @@ library where event.action == "load" and dll.Ext.relative_file_creation_time <=
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Technique:
@@ -140,7 +140,7 @@ library where event.action == "load" and dll.Ext.relative_file_creation_time <=
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
 * Sub-technique:
-** Name: DLL Search Order Hijacking
+** Name: DLL
 ** ID: T1574.001
 ** Reference URL: https://attack.mitre.org/techniques/T1574/001/
 * Sub-technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
index 1116bfcd32..31fa8e1dcc 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-system32-executable.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious instances of default system32 executables, either unsigned
 * Tactic: Persistence
 * Rule Type: BBR
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
@@ -107,7 +107,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-vlc-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-vlc-dll.asciidoc
index 2980938fc1..14beb5a7fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-vlc-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-vlc-dll.asciidoc
@@ -31,7 +31,7 @@ Identifies instances of VLC-related DLLs which are not signed by the original de
 * Tactic: Persistence
 * Rule Type: BBR
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
@@ -69,7 +69,7 @@ library where host.os.type == "windows" and event.action == "load" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
new file mode 100644
index 0000000000..415cd67ac8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-backtick-escaped-variable-expansion.asciidoc
@@ -0,0 +1,113 @@
+[[potential-powershell-obfuscation-via-backtick-escaped-variable-expansion]]
+=== Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
+
+Identifies PowerShell scripts that use backtick-escaped characters inside ${} variable expansion as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """\$\{(\w++`){2,}\w++\}""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, file.name, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
new file mode 100644
index 0000000000..9f281aa9a9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-character-array-reconstruction.asciidoc
@@ -0,0 +1,112 @@
+[[potential-powershell-obfuscation-via-character-array-reconstruction]]
+=== Potential PowerShell Obfuscation via Character Array Reconstruction
+
+Identifies PowerShell scripts that use character arrays and runtime string reconstruction as a form of obfuscation. This technique breaks strings into individual characters, often using constructs like char[] with index-based access or joining logic. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Filter for scripts that contain the "char" keyword using MATCH, boosts the query performance
+| WHERE powershell.file.script_block_text : "char"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(char\[\]\]\(\d+,\d+[^)]+|(\s?\(\[char\]\d+\s?\)\+){2,})""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
new file mode 100644
index 0000000000..42d4c82437
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation.asciidoc
@@ -0,0 +1,109 @@
+[[potential-powershell-obfuscation-via-concatenated-dynamic-command-invocation]]
+=== Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
+
+Identifies PowerShell scripts that use concatenated strings within dynamic command invocation (&() or .()) as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104" and powershell.file.script_block_text LIKE "*+*"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[.&]\(\s*(['"][A-Za-z0-9.-]+['"]\s*\+\s*)+['"][A-Za-z0-9.-]+['"]\s*\)""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
new file mode 100644
index 0000000000..6b86eb7540
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-numeric-character-proportion.asciidoc
@@ -0,0 +1,116 @@
+[[potential-powershell-obfuscation-via-high-numeric-character-proportion]]
+=== Potential PowerShell Obfuscation via High Numeric Character Proportion
+
+Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code manipulation, or embedded encoded strings used to deliver and execute malicious content.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[0-9]""", "🔥")
+
+// Count the occurrence of numbers and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 25%+ proportion of numbers
+| WHERE proportion > 0.25
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-special-character-proportion.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-special-character-proportion.asciidoc
new file mode 100644
index 0000000000..fc3711aa29
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-high-special-character-proportion.asciidoc
@@ -0,0 +1,118 @@
+[[potential-powershell-obfuscation-via-high-special-character-proportion]]
+=== Potential PowerShell Obfuscation via High Special Character Proportion
+
+Identifies PowerShell scripts with an abnormally high proportion of non-alphanumeric characters, often resulting from encoding, string mangling, or dynamic code generation.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+* Rule Type: BBR
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+// Excludes spaces, #, = and - as they are heavily used in scripts for formatting
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[^0-9A-Za-z\s#=-]""", "🔥")
+
+// Count the occurrence of special chars and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 25%+ proportion of special chars
+| WHERE proportion > 0.25
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
new file mode 100644
index 0000000000..fe38f1c2d1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-invalid-escape-sequences.asciidoc
@@ -0,0 +1,112 @@
+[[potential-powershell-obfuscation-via-invalid-escape-sequences]]
+=== Potential PowerShell Obfuscation via Invalid Escape Sequences
+
+Identifies PowerShell scripts that use invalid escape sequences as a form of obfuscation. This technique introduces backticks (`) between characters in a way that does not correspond to valid PowerShell escape sequences, breaking up strings and bypassing pattern-based detections while preserving execution logic. This is designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104" and powershell.file.script_block_text LIKE "*`*"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[A-Za-z0-9_-]`(?![rntb]|\r|\n|\d)[A-Za-z0-9_-]""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.name, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 10
+
+// Filter FPs, and due to the behavior of the LIKE operator, allow null values
+| WHERE (file.name NOT LIKE "TSS_*.psm1" or file.name IS NULL)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-reverse-keywords.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-reverse-keywords.asciidoc
new file mode 100644
index 0000000000..eb914d85a7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-reverse-keywords.asciidoc
@@ -0,0 +1,112 @@
+[[potential-powershell-obfuscation-via-reverse-keywords]]
+=== Potential PowerShell Obfuscation via Reverse Keywords
+
+Identifies PowerShell scripts that use reversed strings as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Filter for scripts that contains these keywords using MATCH, boosts the query performance, match will ignore the | and look for the individual words
+| WHERE powershell.file.script_block_text : "rahc|metsys|stekcos|tcejboimw|ecalper|ecnerferpe|noitcennoc|nioj|eman|vne|gnirts|tcejbo-wen|_23niw|noisserpxe|ekovni|daolnwod"
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """(?i)(rahc|metsys|stekcos|tcejboimw|ecalper|ecnerferpe|noitcennoc|nioj|eman\.|:vne|gnirts|tcejbo-wen|_23niw|noisserpxe|ekovni|daolnwod)""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, agent.id
+| WHERE count >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-special-character-overuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-special-character-overuse.asciidoc
new file mode 100644
index 0000000000..178d4c4d39
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-special-character-overuse.asciidoc
@@ -0,0 +1,116 @@
+[[potential-powershell-obfuscation-via-special-character-overuse]]
+=== Potential PowerShell Obfuscation via Special Character Overuse
+
+Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative of obfuscation. This behavior is commonly associated with techniques such as SecureString encoding, formatting obfuscation, or character-level manipulation designed to bypass static analysis and AMSI inspection.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[\s\$\{\}\+\@\=\(\)\^\\\"~\[\]\?\.]""", "🔥")
+
+// Count the occurrence of numbers and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 75%+ proportion of numbers
+| WHERE proportion > 0.75
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-string-concatenation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-string-concatenation.asciidoc
new file mode 100644
index 0000000000..782999edbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-obfuscation-via-string-concatenation.asciidoc
@@ -0,0 +1,113 @@
+[[potential-powershell-obfuscation-via-string-concatenation]]
+=== Potential PowerShell Obfuscation via String Concatenation
+
+Identifies PowerShell scripts that use string concatenation as a form of obfuscation. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """['"][A-Za-z0-9.]+['"](\s?\+\s?['"][A-Za-z0-9.,\-\s]+['"]){2,}""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-process-name-stomping-with-prctl.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-process-name-stomping-with-prctl.asciidoc
index faa23a188c..bc1aa6a4f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-process-name-stomping-with-prctl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-process-name-stomping-with-prctl.asciidoc
@@ -35,7 +35,7 @@ This rule leverages Auditd data to detect the use of the `prctl` syscall to pote
 * Tactic: Defense Evasion
 * Resources: Investigation Guide
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -153,6 +153,6 @@ process.executable like (
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index 293d84f2bd..81fe097fcf 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -39,7 +39,7 @@ Identifies suspicious instances of the Windows Error Reporting process (WerFault
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 212
+*Version*: 213
 
 *Rule authors*: 
 
@@ -136,6 +136,6 @@ sequence by host.id, process.entity_id with maxspan = 5s
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-obfuscation-via-negative-index-string-reversal.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-obfuscation-via-negative-index-string-reversal.asciidoc
new file mode 100644
index 0000000000..f872e0d0f7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-obfuscation-via-negative-index-string-reversal.asciidoc
@@ -0,0 +1,116 @@
+[[powershell-obfuscation-via-negative-index-string-reversal]]
+=== PowerShell Obfuscation via Negative Index String Reversal
+
+Identifies PowerShell scripts that use negative index ranges to reverse the contents of a string or array at runtime as a form of obfuscation. This technique avoids direct use of reversal functions by iterating through array elements in reverse order. These methods are designed to evade static analysis and bypass security protections such as the Antimalware Scan Interface (AMSI).
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 500 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 500
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """\$\w+\[\-\s?1\.\.""", "🔥")
+
+// Count how many patterns were detected by calculating the number of 🔥 characters inserted
+| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+| WHERE count >= 1
+
+// FP Patterns
+| WHERE NOT powershell.file.script_block_text LIKE "*GENESIS-5654*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
index 03eab73d95..3609e07425 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
@@ -45,7 +45,7 @@ Identifies process execution from suspicious default Windows directories. This i
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 317
+*Version*: 318
 
 *Rule authors*: 
 
@@ -186,6 +186,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
index b309d4d448..9b87cd069b 100644
--- a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
@@ -44,7 +44,7 @@ Identifies execution from a directory masquerading as the Windows Program Files
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -147,6 +147,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/rapid7-threat-command-cves-correlation.asciidoc b/docs/detections/prebuilt-rules/rule-details/rapid7-threat-command-cves-correlation.asciidoc
index b3fc2549f0..ab92111cfd 100644
--- a/docs/detections/prebuilt-rules/rule-details/rapid7-threat-command-cves-correlation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rapid7-threat-command-cves-correlation.asciidoc
@@ -14,9 +14,9 @@ This rule is triggered when CVEs collected from the Rapid7 Threat Command Integr
 * packetbeat-*
 * winlogbeat-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 30m
 
@@ -42,7 +42,7 @@ This rule is triggered when CVEs collected from the Rapid7 Threat Command Integr
 * Use Case: Asset Visibility
 * Use Case: Continuous Monitoring
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-connection-to-webdav-target.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-connection-to-webdav-target.asciidoc
new file mode 100644
index 0000000000..f865ae7bec
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/rare-connection-to-webdav-target.asciidoc
@@ -0,0 +1,105 @@
+[[rare-connection-to-webdav-target]]
+=== Rare Connection to WebDAV Target
+
+Identifies rare connection attempts to a Web Distributed Authoring and Versioning (WebDAV) resource. Attackers may inject WebDAV paths in files or features opened by a victim user to leak their NTLM credentials via forced authentication.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-3660s ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1187/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Rare Connection to WebDAV Target*
+
+
+
+*Possible investigation steps*
+
+
+- Examine the reputation of the destination domain or IP address.
+- Verify if the target user opened any attachments or clicked links pointing to the same target within seconds from the alert timestamp.
+- Correlate the findings with other security logs and alerts to identify any patterns or additional indicators of compromise related to the potential relay attack.
+
+
+*False positive analysis*
+
+
+- User accessing legit WebDAV resources.
+
+
+*Response and remediation*
+
+
+- Conduct a password reset for the target account that may have been compromised or are at risk, ensuring the use of strong, unique passwords.
+- Verify whether other users were targeted but did not open the lure..
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
+- Conduct a post-incident review to identify any gaps in security controls and update policies or procedures to prevent recurrence, ensuring lessons learned are applied to improve overall security posture.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-*
+| where @timestamp > NOW() - 8 hours
+| WHERE event.category == "process" and event.type == "start" and process.name == "rundll32.exe" and process.command_line like "*DavSetCookie*"
+| keep host.id, process.command_line, user.name
+| grok process.command_line """(?<target>DavSetCookie .* http)"""
+| eval webdav_target = REPLACE(target, "(DavSetCookie | http)", "")
+| where webdav_target is not null and webdav_target rlike """(([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,3}(@SSL.*)*|(\d{1,3}\.){3}\d{1,3})""" and not webdav_target in ("www.google.com@SSL", "www.elastic.co@SSL") and not webdav_target rlike """(10\.(\d{1,3}\.){2}\d{1,3}|172\.(1[6-9]|2\d|3[0-1])\.(\d{1,3}\.)\d{1,3}|192\.168\.(\d{1,3}\.)\d{1,3})"""
+| stats total = count(*), unique_count_host = count_distinct(host.id), hosts = VALUES(host.id), users = VALUES(user.name) by webdav_target
+| where unique_count_host == 1 and total <= 3
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Forced Authentication
+** ID: T1187
+** Reference URL: https://attack.mitre.org/techniques/T1187/
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index 4e979adc75..e7128b254b 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -34,7 +34,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 * Data Source: Elastic Defend
 * Data Source: SentinelOne
 
-*Version*: 215
+*Version*: 216
 
 *Rule authors*: 
 
@@ -138,6 +138,6 @@ file where host.os.type == "windows" and event.type == "creation" and process.na
 ** ID: T1105
 ** Reference URL: https://attack.mitre.org/techniques/T1105/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index 672638f884..4edae5dd7d 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -37,7 +37,7 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 214
+*Version*: 215
 
 *Rule authors*: 
 
@@ -131,6 +131,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index 4239c5587c..b323de593b 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -37,7 +37,7 @@ Identifies the execution of a process with a single character process name, diff
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 213
+*Version*: 214
 
 *Rule authors*: 
 
@@ -129,6 +129,6 @@ process where host.os.type == "windows" and event.type == "start" and length(pro
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
new file mode 100644
index 0000000000..da64a87488
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-activity-via-auth-broker-on-behalf-of-principal-user.asciidoc
@@ -0,0 +1,167 @@
+[[suspicious-activity-via-auth-broker-on-behalf-of-principal-user]]
+=== Suspicious Activity via Auth Broker On-Behalf-of Principal User
+
+Identifies suspicious activity from the Microsoft Authentication Broker in Microsoft Entra ID sign-in logs. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to register a device and access Microsoft services as a user. The pattern includes sign-ins from multiple IPs across services (Microsoft Graph, DRS, AAD) using the Authentication Broker client on behalf of a principal user.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-1h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Entra ID
+* Data Source: Entra ID Sign-in Logs
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
+* Tactic: Persistence
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Activity via Auth Broker On-Behalf-of Principal User*
+
+
+This rule identifies suspicious activity from the Microsoft Authentication Broker where the same identity accesses Microsoft Graph at least twice and either Device Registration Service (DRS) or Azure Active Directory (AAD) once — all from multiple unique source IPs within a short window. This behavior may indicate the use of a previously phished refresh token to impersonate a user and register a device, followed by an attempt to acquire a Primary Refresh Token (PRT) for persistent access.
+
+
+*Possible Investigation Steps:*
+
+
+- `target`: The user principal name targeted by the authentication broker. Investigate whether this user has recently registered a device, signed in from new IPs, or has had recent password resets or MFA changes.
+- `azure.signinlogs.identity`: The identity value the broker is acting on behalf of. This may be useful when correlating to device registration records or audit events tied to object IDs.
+- `ips`: Analyze the list of unique IP addresses used within the 30-minute window. Determine whether these originate from different geographic regions, cloud providers, or anonymizing infrastructure (e.g., Tor or VPNs).
+- `incoming_token_type`: Look for values like `"refreshToken"` or `"none"`, which may indicate token replay. `"refreshToken"` suggests broker-based reauthentication using stolen credentials.
+- `user_agents`: Check for mixed user agent strings. Automation tools (e.g., `python-requests`) alongside browser-based agents (e.g., Chrome on macOS) may indicate scripted misuse of tokens.
+- `OS`: Review for inconsistencies. For example, if both `Windows` and `MacOs` appear during a short time span for the same user, this may point to token abuse across multiple environments.
+- `target_time_window`: Use the truncated time window to pivot into raw `azure.signinlogs` to reconstruct the full sequence of resource access events, including exact timestamps and service targets.
+- `azure.auditlogs` to check for device join or registration events around the same timeframe.
+- `azure.identityprotection` to identify correlated risk detections, such as anonymized IP access or token replay.
+- Any additional sign-ins from the `ips` involved, even outside the broker, to determine if tokens have been reused elsewhere.
+
+
+*False Positive Analysis*
+
+
+- This pattern may occur if the user is registering a new device legitimately from two networks (e.g., mobile hotspot and home).
+- Security software (e.g., endpoint detection tools) or identity clients may produce rapid Graph and DRS access in rare edge cases.
+- Developers or IT administrators working across environments may also produce similar behavior.
+
+
+*Response and Remediation*
+
+
+- If confirmed unauthorized, revoke all refresh tokens for the affected user and remove any devices registered during this session.
+- Notify the user and determine whether the device join or authentication activity was expected.
+- Audit Conditional Access and broker permissions (`29d9ed98-a469-4536-ade2-f981bc1d605e`) to ensure policies enforce strict access controls.
+- Consider blocking token-based reauthentication to Microsoft Graph and DRS from suspicious locations or user agents.
+- Continue monitoring for follow-on activity like lateral movement or privilege escalation.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Sign-In Logs*
+
+This rule requires the Microsoft Entra ID Sign-In Logs integration be enabled and configured to collect sign-in logs. In Entra ID, sign-in logs must be enabled and streaming to the Event Hub used for the Azure integration.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+FROM logs-azure.signinlogs* metadata _id, _version, _index
+
+// filter for Microsoft Entra ID Sign-in Logs
+| where event.dataset == "azure.signinlogs"
+
+    // filters on member principals, excluding service principals
+    and azure.signinlogs.properties.user_type == "Member"
+    and source.ip is not null
+    and azure.signinlogs.identity is not null
+    and azure.signinlogs.properties.user_principal_name is not null
+    and event.outcome == "success"
+
+    // filter for successful sign-ins to Microsoft Graph and DRS/AAD from the Microsoft Authentication Broker
+    and (azure.signinlogs.properties.app_display_name == "Microsoft Authentication Broker" or azure.signinlogs.properties.app_id == "29d9ed98-a469-4536-ade2-f981bc1d605e")
+    and azure.signinlogs.properties.resource_display_name in ("Device Registration Service", "Microsoft Graph", "Windows Azure Active Directory")
+
+// keep relevant fields
+| keep @timestamp, azure.signinlogs.identity, source.ip, azure.signinlogs.properties.app_display_name, azure.signinlogs.properties.resource_display_name, azure.signinlogs.properties.user_principal_name, azure.signinlogs.properties.incoming_token_type, user_agent.original, azure.signinlogs.properties.device_detail.operating_system
+
+// aggregate by 30-minute time window
+| eval target_time_window = DATE_TRUNC(30 minutes, @timestamp)
+
+// case statements to track which are MS Graph, DRS, and AAD access
+| eval ms_graph = case(azure.signinlogs.properties.resource_display_name == "Microsoft Graph", source.ip, null), drs = case(azure.signinlogs.properties.resource_display_name == "Device Registration Service", source.ip, null), aad = case(azure.signinlogs.properties.resource_display_name == "Windows Azure Active Directory", source.ip, null)
+
+// aggregate by principal and time window
+// store token types, target user, unique source IPs, and user agents in arrays for investigation
+| stats is_ms_graph = COUNT_DISTINCT(ms_graph), is_drs = COUNT_DISTINCT(drs), is_aad = COUNT_DISTINCT(aad), unique_src_ip = COUNT_DISTINCT(source.ip), ips = VALUES(source.ip), incoming_token_type = VALUES(azure.signinlogs.properties.incoming_token_type), target = VALUES(azure.signinlogs.properties.user_principal_name), user_agents = VALUES(user_agent.original), OS = VALUES(azure.signinlogs.properties.device_detail.operating_system) by azure.signinlogs.identity, target_time_window
+
+// filter for cases with multiple unique source IPs, and at least one DRS or AAD access, and multiple MS Graph accesses
+| where unique_src_ip >= 2 and (is_drs >= 1 or is_aad >= 1) and is_ms_graph >= 2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Device Registration
+** ID: T1098.005
+** Reference URL: https://attack.mitre.org/techniques/T1098/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index 7396b86644..7286f463a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -41,7 +41,7 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
 * Data Source: SentinelOne
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 317
+*Version*: 318
 
 *Rule authors*: 
 
@@ -166,6 +166,6 @@ file where host.os.type == "windows" and event.type != "deletion" and file.path
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
 * Sub-technique:
-** Name: DLL Search Order Hijacking
+** Name: DLL
 ** ID: T1574.001
 ** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
index 282e27ff9c..067d7e7bf4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-communication-app-child-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious child processes of communications apps, which can indicate
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 9
+*Version*: 10
 
 *Rule authors*: 
 
@@ -299,7 +299,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
index 62e6db4f68..bf46c02d0e 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -44,7 +44,7 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -218,7 +218,7 @@ any where host.os.type == "windows" and
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
 * Sub-technique:
-** Name: DLL Search Order Hijacking
+** Name: DLL
 ** ID: T1574.001
 ** Reference URL: https://attack.mitre.org/techniques/T1574/001/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
index bd26c987b9..419ea4a34f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
@@ -42,7 +42,7 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 317
+*Version*: 318
 
 *Rule authors*: 
 
@@ -144,6 +144,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-kernel-feature-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-kernel-feature-activity.asciidoc
new file mode 100644
index 0000000000..47f34aade4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-kernel-feature-activity.asciidoc
@@ -0,0 +1,93 @@
+[[suspicious-kernel-feature-activity]]
+=== Suspicious Kernel Feature Activity
+
+This rule detects the modification and reading of kernel features through built-in commands. Attackers may collect information, disable or weaken Linux kernel protections. For example, an attacker may modify ASLR protection by disabling kernel.randomize_va_space, allow ptrace by setting kernel.yama.ptrace_scope to 0, or disable the NMI watchdog by setting kernel.nmi_watchdog to 0. These changes may be used to impair defenses and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Discovery
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
+process.command_line : (
+  "*/etc/sysctl.conf*", "*/etc/sysctl.d/*", "*/proc/sys/kernel/nmi_watchdog*",
+  "*/proc/sys/vm/nr_hugepages*", "*/proc/sys/kernel/yama/ptrace_scope*",
+  "*/proc/sys/kernel/randomize_va_space*", "*/proc/sys/vm/drop_caches*",
+  "*/proc/sys/kernel/sysrq*", "*grsecurity*", "*exec-shield*",
+  "*kernel.randomize_va_space*", "*kernel.yama.ptrace_scope*",
+  "*kernel.nmi_watchdog*", "*vm.nr_hugepages*", "*vm.drop_caches*",
+  "*kernel.sysrq*"
+) and
+process.parent.executable != null and 
+(
+  (process.name == "tee" and process.args like "-*a*") or // also detects --append
+  (process.name == "cat" and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or
+  (process.name == "grep" and process.args_count == 3 and not process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")) or
+  (process.name == "sysctl" and process.args like ("*-w*", "*--write*", "*=*")) or
+  (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.args == "-c" and process.args : "*echo *")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
new file mode 100644
index 0000000000..78bb42ee8d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc
@@ -0,0 +1,136 @@
+[[suspicious-microsoft-365-userloggedin-via-oauth-code]]
+=== Suspicious Microsoft 365 UserLoggedIn via OAuth Code
+
+Identifies sign-ins on behalf of a principal user to the Microsoft Graph API from multiple IPs using the Microsoft Authentication Broker or Visual Studio Code application. This behavior may indicate an adversary using a phished OAuth refresh token.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-1h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Defense Evasion
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Microsoft 365 UserLoggedIn via OAuth Code*
+
+
+
+*Possible Investigation Steps:*
+
+
+- `o365.audit.UserId`: The identity value the application is acting on behalf of principal user.
+- `unique_ips`: Analyze the list of unique IP addresses used within the 30-minute window. Determine whether these originate from different geographic regions, cloud providers, or anonymizing infrastructure (e.g., Tor or VPNs).
+- `target_time_window`: Use the truncated time window to pivot into raw events to reconstruct the full sequence of resource access events, including exact timestamps and service targets.
+- `azure.auditlogs` to check for device join or registration events around the same timeframe.
+- `azure.identityprotection` to identify correlated risk detections, such as anonymized IP access or token replay.
+- Any additional sign-ins from the `ips` involved, even outside the broker, to determine if tokens have been reused elsewhere.
+
+
+*False Positive Analysis*
+
+
+- Developers or IT administrators working across environments may also produce similar behavior.
+
+
+*Response and Remediation*
+
+
+- If confirmed unauthorized, revoke all refresh tokens for the affected user and remove any devices registered during this session.
+- Notify the user and determine whether the device join or authentication activity was expected.
+- Audit Conditional Access and broker permissions (`29d9ed98-a469-4536-ade2-f981bc1d605e`) to ensure policies enforce strict access controls.
+- Consider blocking token-based reauthentication to Microsoft Graph and DRS from suspicious locations or user agents.
+- Continue monitoring for follow-on activity like lateral movement or privilege escalation.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-o365.audit-default*
+| WHERE event.dataset == "o365.audit" and event.action == "UserLoggedIn" and
+  source.ip is not null and o365.audit.UserId is not null and o365.audit.ApplicationId is not null and o365.audit.UserType in ("0", "2", "3", "10") and 
+
+  // filter for successful logon to Microsoft Graph and from the Microsoft Authentication Broker or Visual Studio Code
+  o365.audit.ApplicationId in ("aebc6443-996d-45c2-90f0-388ff96faa56", "29d9ed98-a469-4536-ade2-f981bc1d605e") and
+  o365.audit.ObjectId in ("00000003-0000-0000-c000-000000000000")
+
+// keep relevant fields only
+| keep @timestamp, o365.audit.UserId, source.ip, o365.audit.ApplicationId, o365.audit.ObjectId, o365.audit.ExtendedProperties.RequestType, source.as.organization.name, o365.audit.ExtendedProperties.ResultStatusDetail
+
+// case statements to track which are OAuth2 authorization request via redirect and which are related to OAuth2 code to token conversion
+| eval oauth_authorize = case(o365.audit.ExtendedProperties.RequestType == "OAuth2:Authorize" and o365.audit.ExtendedProperties.ResultStatusDetail == "Redirect", o365.audit.UserId, null), oauth_token = case(o365.audit.ExtendedProperties.RequestType == "OAuth2:Token", o365.audit.UserId, null)
+
+// split time to 30 minutes intervals
+| eval target_time_window = DATE_TRUNC(30 minutes, @timestamp)
+
+// aggregate by principal, applicationId, objectId and time window
+| stats unique_ips = COUNT_DISTINCT(source.ip), source_ips = VALUES(source.ip), appIds = VALUES(o365.audit.ApplicationId), asn = values(`source.as.organization.name`), is_oauth_token = COUNT_DISTINCT(oauth_token), is_oauth_authorize = COUNT_DISTINCT(oauth_authorize) by o365.audit.UserId, target_time_window, o365.audit.ApplicationId, o365.audit.ObjectId
+
+// filter for cases where the same appId is used by the same principal user to access the same object and from multiple addresses via OAuth2 token
+| where unique_ips >= 2 and is_oauth_authorize > 0 and is_oauth_token > 0
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Application Access Token
+** ID: T1550.001
+** Reference URL: https://attack.mitre.org/techniques/T1550/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-named-pipe-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-named-pipe-creation.asciidoc
new file mode 100644
index 0000000000..498bb4d999
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-named-pipe-creation.asciidoc
@@ -0,0 +1,111 @@
+[[suspicious-named-pipe-creation]]
+=== Suspicious Named Pipe Creation
+
+This rule detects the creation of unusually labeled named pipes (FIFOs) by the mkfifo command, which is often used by attackers to establish persistence on a target system or to execute commands in the background. Through the new_terms rule type, this rule can identify uncommon process command lines that may indicate the presence of a malicious named pipe.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.name:mkfifo and
+process.parent.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
+process.args:((/dev/shm/* or /tmp/* or /var/tmp/*) and not /*fifo*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-outlook-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-outlook-child-process.asciidoc
index 93cf21c7f8..bb978ec13c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-outlook-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-outlook-child-process.asciidoc
@@ -31,7 +31,7 @@ Identifies suspicious child processes spawned by MS Outlook, which can indicate
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -97,7 +97,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036.001
 ** Reference URL: https://attack.mitre.org/techniques/T1036/001/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-path-mounted.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-path-mounted.asciidoc
new file mode 100644
index 0000000000..820b991fad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-path-mounted.asciidoc
@@ -0,0 +1,101 @@
+[[suspicious-path-mounted]]
+=== Suspicious Path Mounted
+
+This rule detects suspicious paths mounted on Linux systems. The mount command is used to attach filesystems to the system, and attackers may use it to mount malicious filesystems or directories for data exfiltration or persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "mount" and 
+process.args like ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*", "/root/*", "/mount") and process.parent.executable != null and
+not (
+  process.parent.executable like ("/bin/*", "/usr/bin/*", "/usr/local/bin/*", "/sbin/*", "/usr/sbin/*", "/usr/local/sbin/*", "/usr/libexec/*") or
+  process.parent.name == "snapd"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
index 3b4eecb3af..085dd54b7a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-proc-maps-discovery.asciidoc
@@ -7,7 +7,10 @@ Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a
 
 *Rule indices*: 
 
+* endgame-*
+* logs-crowdstrike.fdr*
 * logs-endpoint.events.process*
+* logs-sentinel_one_cloud_funnel.*
 
 *Severity*: low
 
@@ -30,9 +33,12 @@ Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a
 * Use Case: Threat Detection
 * Tactic: Discovery
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
@@ -96,7 +102,6 @@ In Linux environments, the `/proc/*/maps` files provide detailed memory mapping
 *Setup*
 
 
-
 This rule requires data coming in from Elastic Defend.
 
 
@@ -132,10 +137,8 @@ For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/
 
 [source, js]
 ----------------------------------
-process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
-process.name in ("cat", "grep") and process.args : "/proc/*/maps" and process.entry_leader.name in (
-  "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish"
-)
+process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start", "ProcessRollup2") and
+process.name in ("cat", "grep", "tail", "less", "more", "egrep", "fgrep") and process.args like "/proc/*/maps"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
index 61d486dc84..1fb8b72ee3 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -38,7 +38,7 @@ Identifies suspicious psexec activity which is executing from the psexec service
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 214
+*Version*: 215
 
 *Rule authors*: 
 
@@ -125,6 +125,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
index 5fa53870a1..576642e9f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-files.asciidoc
@@ -32,7 +32,7 @@ Identifies instances where VMware-related files, such as those with extensions l
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 10
+*Version*: 11
 
 *Rule authors*: 
 
@@ -149,6 +149,6 @@ and not file.name : ("*.vmdk", "*.vmx", "*.vmxf", "*.vmsd", "*.vmsn", "*.vswp",
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
index 69161c1c0d..a6a76e4fea 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc
@@ -32,7 +32,7 @@ Identifies instances where the "index.html" file within the "/usr/lib/vmware/*"
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 10
+*Version*: 11
 
 *Rule authors*: 
 
@@ -148,6 +148,6 @@ file.Ext.original.path : "/usr/lib/vmware/*"
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc
index f27993b916..50e40948c0 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc
@@ -45,7 +45,7 @@ Identifies suspicious processes being spawned by the ScreenConnect client proces
 * Data Source: Windows Security Event Logs
 * Data Source: Crowdstrike
 
-*Version*: 311
+*Version*: 312
 
 *Rule authors*: 
 
@@ -137,6 +137,6 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-binary-moved-or-copied.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-binary-moved-or-copied.asciidoc
index 2c56407a1b..46c9a126a8 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-binary-moved-or-copied.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-binary-moved-or-copied.asciidoc
@@ -33,7 +33,7 @@ This rule monitors for the copying or moving of a system binary. Adversaries may
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 16
+*Version*: 17
 
 *Rule authors*: 
 
@@ -182,7 +182,7 @@ file.Ext.original.path : (
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Rename System Utilities
+** Name: Rename Legitimate Utilities
 ** ID: T1036.003
 ** Reference URL: https://attack.mitre.org/techniques/T1036/003/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/system-binary-symlink-to-suspicious-location.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-binary-symlink-to-suspicious-location.asciidoc
new file mode 100644
index 0000000000..89e9062d6d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-binary-symlink-to-suspicious-location.asciidoc
@@ -0,0 +1,77 @@
+[[system-binary-symlink-to-suspicious-location]]
+=== System Binary Symlink to Suspicious Location
+
+This rule detects the creation of a symbolic link from a system binary to a suspicious and writable location. This activity may indicate an attacker's attempt to evade detection by behavioral rules that depend on predefined process parent/child relationships. By executing the symlinked variant of a binary instead of the original, the attacker aims to bypass these rules. Through the new_terms rule type, this rule can identify uncommon parent processes that may indicate the presence of a malicious symlink.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.parent.executable:* and
+(process.name:ln or process.name:busybox and process.args:ln or process.name:cp and process.args:--symbolic-link) and
+process.args:(
+  (
+    /bin/* or /lib/* or /lib64/* or /sbin/* or /usr/bin/* or /usr/lib/* or /usr/lib64/* or /usr/local/bin/* or
+    /usr/local/lib/* or /usr/local/lib64/* or /usr/local/sbin/* or /usr/sbin/*
+  ) and (
+    /*/.* or /dev/shm/* or /home/* or /root/* or /tmp/* or /var/tmp/*
+  ) and
+  not (/usr/bin/coreutils or /tmp/mkinitcpio* or /var/tmp/dracut* or /var/tmp/mkinitramfs*)
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-email-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-email-indicator-match.asciidoc
index 97096b6aea..b3d83a1f78 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-email-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-email-indicator-match.asciidoc
@@ -10,9 +10,9 @@ This rule is triggered when an email indicator from the Threat Intel Filebeat mo
 * filebeat-*
 * logs-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 1h
 
@@ -31,7 +31,7 @@ This rule is triggered when an email indicator from the Threat Intel Filebeat mo
 * Rule Type: Threat Match
 * Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index ad18217031..caa105470b 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -13,9 +13,9 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 * logs-*
 * winlogbeat-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 1h
 
@@ -36,7 +36,7 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 * Rule Type: Threat Match
 * Resources: Investigation Guide
 
-*Version*: 9
+*Version*: 10
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index bffcc1d579..0e9cc65f9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -14,9 +14,9 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 * packetbeat-*
 * winlogbeat-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 1h
 
@@ -37,7 +37,7 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 * Rule Type: Threat Match
 * Resources: Investigation Guide
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index 1918ee98ac..562f55f68f 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -14,9 +14,9 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 * packetbeat-*
 * winlogbeat-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 1h
 
@@ -37,7 +37,7 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 * Rule Type: Threat Match
 * Resources: Investigation Guide
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index d47427c15b..773e202a2a 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -13,9 +13,9 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 * logs-*
 * winlogbeat-*
 
-*Severity*: critical
+*Severity*: high
 
-*Risk score*: 99
+*Risk score*: 73
 
 *Runs every*: 1h
 
@@ -36,7 +36,7 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 * Rule Type: Threat Match
 * Resources: Investigation Guide
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 5dc6502c02..9a9e4c7137 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -47,7 +47,7 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 319
+*Version*: 320
 
 *Rule authors*: 
 
@@ -156,7 +156,7 @@ process where host.os.type == "windows" and event.type == "start" and
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-a-trusted-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-a-trusted-process.asciidoc
index a30626b337..e1bc68b27d 100644
--- a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-a-trusted-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-a-trusted-process.asciidoc
@@ -30,7 +30,7 @@ Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
@@ -103,7 +103,7 @@ library where host.os.type == "windows" and
 ** ID: T1574
 ** Reference URL: https://attack.mitre.org/techniques/T1574/
 * Sub-technique:
-** Name: DLL Search Order Hijacking
+** Name: DLL
 ** ID: T1574.001
 ** Reference URL: https://attack.mitre.org/techniques/T1574/001/
 * Sub-technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
new file mode 100644
index 0000000000..9186748bee
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-execution-from-kernel-thread-kthreadd-parent.asciidoc
@@ -0,0 +1,119 @@
+[[unusual-execution-from-kernel-thread-kthreadd-parent]]
+=== Unusual Execution from Kernel Thread (kthreadd) Parent
+
+This rule detects suspicious child process from the kernel thread (kthreadd) parent process. Attackers may execute payloads from kernel space via kthreadd to perform actions on the host and evade detection. Through the usage of the new_terms rule type, this rule can identify uncommon child processes that may indicate the presence of a malicious process.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and process.parent.name:kthreadd and (
+  process.executable:(/dev/shm/* or /tmp/* or /var/tmp/* or /var/www/*) or
+  process.name:(bash or csh or curl or dash or fish or id or ksh or nohup or setsid or sh or tcsh or wget or whoami or zsh)
+) and
+process.command_line:(
+  */dev/shm/* or */dev/tcp/* or */etc/init.d* or */etc/ld.so* or */etc/profile* or */etc/rc.local* or */etc/shadow* or */etc/ssh* or
+  */etc/sudoers* or */home/*/.ssh/* or */root/.ssh* or */tmp/* or */var/log/* or */var/run/* or */var/tmp/* or */var/www/* or
+  *base64* or *cron* or *xxd* or *~/.ssh/*
+) and not (
+  process.name:(true or cifs.upcall or dpkg or flock or gdbus or getopt or grep or mount or touch or umount or uname) or
+  process.command_line:(
+    "sh -c /bin/true" or */bin/ps* or */usr/bin/find* or */usr/bin/grep* or *ds_agent* or *gitlabrunner* or *nagios* or
+    *omsagent* or *pgrep*
+  ) or
+  process.executable:(
+    /lib/systemd/systemd-cgroups-agent or /proc/self/exe or /usr/local/axs-haproxy-monitoring/haproxy_stats.sh or /tmp/newroot/* or
+    /var/lib/docker/overlay2/* or /vz/root/*
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-exim4-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-exim4-child-process.asciidoc
new file mode 100644
index 0000000000..e58fabb8da
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-exim4-child-process.asciidoc
@@ -0,0 +1,70 @@
+[[unusual-exim4-child-process]]
+=== Unusual Exim4 Child Process
+
+This rule detects the execution of unusual commands via a descendant process of exim4. Attackers may use descendant processes of exim4 to evade detection and establish persistence or execute post-exploitation commands on a target system.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.qualys.com/2021/05/04/21nails/21nails.txt
+* https://blog.qualys.com/vulnerabilities-threat-research/2021/05/04/21nails-multiple-vulnerabilities-in-exim-mail-server
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.type:start and event.action:exec and process.parent.name:exim4 and
+not process.name:(
+  exim4 or start-stop-daemon or run-parts or systemctl or update-exim4.conf or install or plymouth or
+  readlink or grep or stat or cmake or gcc or cppcheck or sort or sshd
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Initialization Scripts
+** ID: T1037
+** Reference URL: https://attack.mitre.org/techniques/T1037/
+* Technique:
+** Name: Compromise Host Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
new file mode 100644
index 0000000000..239c12c13f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-ld-preload-ld-library-path-command-line-arguments.asciidoc
@@ -0,0 +1,132 @@
+[[unusual-ld-preload-ld-library-path-command-line-arguments]]
+=== Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments
+
+This rule detects the use of the LD_PRELOAD and LD_LIBRARY_PATH environment variables in a command line argument. This behavior is unusual and may indicate an attempt to hijack the execution flow of a process. Threat actors may use this technique to evade defenses, escalate privileges, or maintain persistence on a system.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:linux and event.category:process and event.type:start and event.action:exec and
+process.parent.name:(* and not (
+  awk or bwrap or cylancesvc or dbus-run-session or java or julia or make or matlab_helper or ninja or noproc_sandbox or
+  nxrunner or nxserver or perl or rear or sapcontrol or setsid or spoold or sshd or steam or su or sudo or titanagent or
+  vls_agent or zabbix_agentd
+)) and
+process.name:(bash or csh or dash or fish or ksh or sh or tcsh or zsh) and
+process.args:-c and process.command_line:(*LD_LIBRARY_PATH=* or *LD_PRELOAD=*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 2c23b9c6cd..076faea661 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -34,7 +34,7 @@ Identifies network activity from unexpected system applications. This may indica
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -197,7 +197,7 @@ sequence by process.entity_id with maxspan=5m
 ** ID: T1036
 ** Reference URL: https://attack.mitre.org/techniques/T1036/
 * Sub-technique:
-** Name: Match Legitimate Name or Location
+** Name: Match Legitimate Resource Name or Location
 ** ID: T1036.005
 ** Reference URL: https://attack.mitre.org/techniques/T1036/005/
 * Technique:
diff --git a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
index 9864d999e2..a4c1ced620 100644
--- a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-from-the-internet.asciidoc
@@ -35,7 +35,7 @@ This rule detects network events that may indicate the use of VNC traffic from t
 * Data Source: PAN-OS
 * Resources: Investigation Guide
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
@@ -142,7 +142,7 @@ VNC allows remote control of systems, facilitating maintenance and resource shar
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
 * Tactic:
diff --git a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
index 2ef1bb8ea5..82c6228f42 100644
--- a/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/vnc-virtual-network-computing-to-the-internet.asciidoc
@@ -35,7 +35,7 @@ This rule detects network events that may indicate the use of VNC traffic to the
 * Data Source: PAN-OS
 * Resources: Investigation Guide
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
@@ -143,6 +143,6 @@ VNC is a tool that allows remote control of computers, often used by administrat
 ** ID: TA0011
 ** Reference URL: https://attack.mitre.org/tactics/TA0011/
 * Technique:
-** Name: Remote Access Software
+** Name: Remote Access Tools
 ** ID: T1219
 ** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-sandbox-with-sensitive-configuration.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-sandbox-with-sensitive-configuration.asciidoc
new file mode 100644
index 0000000000..3584201e8c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/windows-sandbox-with-sensitive-configuration.asciidoc
@@ -0,0 +1,81 @@
+[[windows-sandbox-with-sensitive-configuration]]
+=== Windows Sandbox with Sensitive Configuration
+
+Identifies Windows sanfbox processes indicating the start of a new container with sensitive configurations like write access to the host file system, network connection and automatic execution via logon command. Malware may abuse the sandbox feature to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog-en.itochuci.co.jp/entry/2025/03/12/140000
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wsb.exe", "WindowsSandboxClient.exe") and
+  process.command_line : ("*<Networking>Enable</Networking>*",
+                          "*<HostFolder>C:\\*<ReadOnly>false*",
+                          "*<LogonCommand>*",
+                          "*<NetworkingEnabled>true*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Run Virtual Instance
+** ID: T1564.006
+** Reference URL: https://attack.mitre.org/techniques/T1564/006/
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index bb2eeca760..db9c3ba269 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -103,3 +103,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-17-8/prebuilt-rules-8
 include::detections/prebuilt-rules/downloadable-packages/8-17-9/prebuilt-rules-8-17-9-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-17-10/prebuilt-rules-8-17-10-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rules-8-17-11-appendix.asciidoc[]

From abe52e2e4943ba4a1cfadf95692d2bbdbbc3d731 Mon Sep 17 00:00:00 2001
From: Shashank K S <Shashank.Suryanarayana@elastic.co>
Date: Wed, 7 May 2025 16:39:25 +0530
Subject: [PATCH 2/2] Fix broken Links

---
 ...harepoint-access-for-user-principal-via-auth-broker.asciidoc | 2 +-
 ...harepoint-access-for-user-principal-via-auth-broker.asciidoc | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
index 87d399fd27..c287785ad9 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-17-11/prebuilt-rule-8-17-11-microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
@@ -57,7 +57,7 @@ This rule detects non-interactive authentication activity against SharePoint Onl
 
 This rule identifies non-interactive sign-ins to SharePoint Online via the Microsoft Authentication Broker application using a refresh token or Primary Refresh Token (PRT). This type of activity may indicate token replay attacks, OAuth abuse, or automated access from previously consented apps or stolen sessions.
 
-This is a https://www.elastic.co/guide/en/security/current/new-terms-rules.html[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
 
 
 *Possible Investigation Steps:*
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
index 33a6d6dc7d..573ac4b4db 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker.asciidoc
@@ -57,7 +57,7 @@ This rule detects non-interactive authentication activity against SharePoint Onl
 
 This rule identifies non-interactive sign-ins to SharePoint Online via the Microsoft Authentication Broker application using a refresh token or Primary Refresh Token (PRT). This type of activity may indicate token replay attacks, OAuth abuse, or automated access from previously consented apps or stolen sessions.
 
-This is a https://www.elastic.co/guide/en/security/current/new-terms-rules.html[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms rule] that detects the first occurrence of a user principal name accessing SharePoint Online via the Microsoft Authentication Broker application in the last 14 days.
 
 
 *Possible Investigation Steps:*