From 4665792720d745720cd06c5151b7a7dc91b62d26 Mon Sep 17 00:00:00 2001
From: tradebot-elastic <178941316+tradebot-elastic@users.noreply.github.com>
Date: Thu, 18 Sep 2025 07:27:24 +0000
Subject: [PATCH] Update latest docs

---
 ...oken-used-from-multiple-addresses.asciidoc | 212 +++++++++++
 ...aws-dynamodb-scan-by-unusual-user.asciidoc | 128 +++++++
 ...aws-dynamodb-table-exported-to-s3.asciidoc | 113 ++++++
 ...e-connect-ssh-public-key-uploaded.asciidoc | 141 +++++++
 ...18-14-aws-ec2-route-table-created.asciidoc | 121 ++++++
 ...2-route-table-modified-or-deleted.asciidoc | 145 +++++++
 ...-via-assumed-role-on-ec2-instance.asciidoc | 133 +++++++
 ...icy-attached-to-role-by-rare-user.asciidoc | 131 +++++++
 ...ated-bucket-access-by-rare-source.asciidoc | 182 +++++++++
 ...are-protocol-subscription-by-user.asciidoc | 144 +++++++
 ...ws-sns-topic-created-by-rare-user.asciidoc | 165 ++++++++
 ...opic-message-publish-by-rare-user.asciidoc | 177 +++++++++
 ...m-session-started-to-ec2-instance.asciidoc | 125 ++++++
 ...18-14-bypass-uac-via-event-viewer.asciidoc | 170 +++++++++
 ...-clearing-windows-console-history.asciidoc | 149 ++++++++
 ...18-14-clearing-windows-event-logs.asciidoc | 143 +++++++
 ...g-interpreter-via-windows-scripts.asciidoc | 138 +++++++
 ...-component-object-model-hijacking.asciidoc | 211 +++++++++++
 ...on-large-language-model-endpoints.asciidoc | 179 +++++++++
 ...n-to-commonly-abused-web-services.asciidoc | 333 ++++++++++++++++
 ...18-14-crowdstrike-external-alerts.asciidoc | 116 ++++++
 ...ule-8-18-14-d-bus-service-created.asciidoc | 190 ++++++++++
 ...written-or-modified-by-pdf-reader.asciidoc | 152 ++++++++
 ...ecurity-logs-using-built-in-tools.asciidoc | 156 ++++++++
 ...-security-settings-via-powershell.asciidoc | 153 ++++++++
 ...ncrypting-files-with-winrar-or-7z.asciidoc | 149 ++++++++
 ...14-entra-id-mfa-disabled-for-user.asciidoc | 129 +++++++
 ...ction-risk-detection-sign-in-risk.asciidoc | 154 ++++++++
 ...otection-risk-detection-user-risk.asciidoc | 151 ++++++++
 ...nge-mailbox-export-via-powershell.asciidoc | 130 +++++++
 ...ssql-xp-cmdshell-stored-procedure.asciidoc | 161 ++++++++
 ...nnections-from-unusual-executable.asciidoc | 198 ++++++++++
 ...8-18-14-iis-http-logging-disabled.asciidoc | 129 +++++++
 ...4-lsass-memory-dump-handle-access.asciidoc | 177 +++++++++
 ...m365-portal-login-atypical-travel.asciidoc | 130 +++++++
 ...65-portal-login-impossible-travel.asciidoc | 130 +++++++
 ...-high-malicious-probability-score.asciidoc | 153 ++++++++
 ...a-low-malicious-probability-score.asciidoc | 153 ++++++++
 ...-activation-for-okta-user-account.asciidoc | 124 ++++++
 ...lobal-administrator-role-assigned.asciidoc | 125 ++++++
 ...-grant-via-registered-application.asciidoc | 148 ++++++++
 ...ing-via-visual-studio-code-client.asciidoc | 136 +++++++
 ...-grant-via-registered-application.asciidoc | 138 +++++++
 ...user-reported-suspicious-activity.asciidoc | 119 ++++++
 ...ker-spawning-suspicious-processes.asciidoc | 145 +++++++
 ...irst-occurrence-of-client-request.asciidoc | 125 ++++++
 ...nt-console-file-from-unusual-path.asciidoc | 163 ++++++++
 ...tion-of-wdigest-security-provider.asciidoc | 139 +++++++
 ...otection-alerts-by-user-principal.asciidoc | 119 ++++++
 ...-device-token-hash-behind-a-proxy.asciidoc | 140 +++++++
 ...-to-a-suspicious-top-level-domain.asciidoc | 128 +++++++
 ...ign-in-events-via-third-party-idp.asciidoc | 130 +++++++
 ...k-home-page-registry-modification.asciidoc | 135 +++++++
 ...tial-credential-access-via-dcsync.asciidoc | 168 +++++++++
 ...tial-access-via-windows-utilities.asciidoc | 175 +++++++++
 ...ng-via-trusted-microsoft-programs.asciidoc | 166 ++++++++
 ...e-download-via-a-headless-browser.asciidoc | 122 ++++++
 ...re-driven-ssh-brute-force-attempt.asciidoc | 198 ++++++++++
 ...ication-of-accessibility-binaries.asciidoc | 180 +++++++++
 ...fa-bombing-via-push-notifications.asciidoc | 138 +++++++
 ...ng-activity-from-compromised-host.asciidoc | 184 +++++++++
 ...ershell-hacktool-script-by-author.asciidoc | 165 ++++++++
 ...hacktool-script-by-function-names.asciidoc | 356 ++++++++++++++++++
 ...ege-escalation-via-cve-2022-38028.asciidoc | 146 +++++++
 ...h-count-of-readme-files-by-system.asciidoc | 134 +++++++
 ...remote-desktop-shadowing-activity.asciidoc | 142 +++++++
 ...ng-activity-from-compromised-host.asciidoc | 169 +++++++++
 ...m-tampering-via-file-modification.asciidoc | 123 ++++++
 ...fa-bombing-via-push-notifications.asciidoc | 141 +++++++
 ...owershell-kerberos-ticket-request.asciidoc | 163 ++++++++
 ...ershell-mailbox-collection-script.asciidoc | 181 +++++++++
 ...s-defender-tampering-capabilities.asciidoc | 175 +++++++++
 ...wershell-share-enumeration-script.asciidoc | 174 +++++++++
 ...t-with-audio-capture-capabilities.asciidoc | 167 ++++++++
 ...-clipboard-retrieval-capabilities.asciidoc | 171 +++++++++
 ...n-via-windir-environment-variable.asciidoc | 133 +++++++
 ...-remote-execution-via-file-shares.asciidoc | 162 ++++++++
 ...mote-file-download-via-powershell.asciidoc | 166 ++++++++
 ...ver-spawning-suspicious-processes.asciidoc | 145 +++++++
 ...ation-from-unusual-ssh-public-key.asciidoc | 141 +++++++
 ...picious-access-to-ldap-attributes.asciidoc | 129 +++++++
 ...y-application-via-microsoft-graph.asciidoc | 131 +++++++
 ...picious-execution-from-inet-cache.asciidoc | 160 ++++++++
 ...oft-antimalware-service-execution.asciidoc | 144 +++++++
 ...soft-diagnostics-wizard-execution.asciidoc | 145 +++++++
 ...startup-shell-folder-modification.asciidoc | 184 +++++++++
 ...8-14-system-file-ownership-change.asciidoc | 131 +++++++
 ...public-ip-discovery-via-dns-query.asciidoc | 181 +++++++++
 ...e-8-18-14-untrusted-driver-loaded.asciidoc | 144 +++++++
 ...ess-from-a-system-virtual-process.asciidoc | 124 ++++++
 ...-unusual-child-process-of-dns-exe.asciidoc | 139 +++++++
 ...-execution-from-web-server-parent.asciidoc | 238 ++++++++++++
 ...via-microsoft-common-console-file.asciidoc | 153 ++++++++
 ...unusual-file-operation-by-dns-exe.asciidoc |  71 ++++
 ...al-file-transfer-utility-launched.asciidoc | 162 ++++++++
 ...ss-spawned-from-web-server-parent.asciidoc | 255 +++++++++++++
 ...-account-exposed-to-kerberoasting.asciidoc | 154 ++++++++
 ...ess-child-of-common-web-processes.asciidoc | 193 ++++++++++
 ...r-exclusions-added-via-powershell.asciidoc | 165 ++++++++
 ...-firewall-disabled-via-powershell.asciidoc | 150 ++++++++
 ...e-installed-via-an-unusual-client.asciidoc | 157 ++++++++
 .../prebuilt-rules-8-18-14-appendix.asciidoc  | 107 ++++++
 .../prebuilt-rules-8-18-14-summary.asciidoc   | 214 +++++++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |   5 +
 .../prebuilt-rules-reference.asciidoc         | 220 +++++------
 .../prebuilt-rules/rule-desc-index.asciidoc   |  18 +-
 ...oken-used-from-multiple-addresses.asciidoc |  21 +-
 ...aws-dynamodb-scan-by-unusual-user.asciidoc |  12 +-
 ...aws-dynamodb-table-exported-to-s3.asciidoc |   9 +-
 ...e-connect-ssh-public-key-uploaded.asciidoc |  15 +-
 .../aws-ec2-route-table-created.asciidoc      | 121 ++++++
 ...2-route-table-modified-or-deleted.asciidoc |  17 +-
 ...-via-assumed-role-on-ec2-instance.asciidoc |  15 +-
 ...icy-attached-to-role-by-rare-user.asciidoc |   3 +-
 ...ated-bucket-access-by-rare-source.asciidoc |  50 +--
 ...are-protocol-subscription-by-user.asciidoc | 144 +++++++
 ...ws-sns-topic-created-by-rare-user.asciidoc |  37 +-
 ...opic-message-publish-by-rare-user.asciidoc | 177 +++++++++
 ...m-session-started-to-ec2-instance.asciidoc | 125 ++++++
 .../bypass-uac-via-event-viewer.asciidoc      |   6 +-
 .../clearing-windows-console-history.asciidoc |   4 +-
 .../clearing-windows-event-logs.asciidoc      |   4 +-
 ...g-interpreter-via-windows-scripts.asciidoc |   8 +-
 .../component-object-model-hijacking.asciidoc |  77 ++--
 ...on-large-language-model-endpoints.asciidoc |   7 +-
 ...n-to-commonly-abused-web-services.asciidoc |  81 ++--
 .../crowdstrike-external-alerts.asciidoc      |   4 +-
 .../d-bus-service-created.asciidoc            |   3 +-
 ...written-or-modified-by-pdf-reader.asciidoc | 152 ++++++++
 ...ecurity-logs-using-built-in-tools.asciidoc |   4 +-
 ...-security-settings-via-powershell.asciidoc |   4 +-
 ...ncrypting-files-with-winrar-or-7z.asciidoc |  20 +-
 .../entra-id-mfa-disabled-for-user.asciidoc   |   3 +-
 ...ction-risk-detection-sign-in-risk.asciidoc |   3 +-
 ...otection-risk-detection-user-risk.asciidoc |   3 +-
 ...nge-mailbox-export-via-powershell.asciidoc |   2 +-
 ...ssql-xp-cmdshell-stored-procedure.asciidoc |  41 +-
 ...nnections-from-unusual-executable.asciidoc |  16 +-
 .../iis-http-logging-disabled.asciidoc        |   4 +-
 .../lsass-memory-dump-handle-access.asciidoc  |  48 +--
 ...m365-portal-login-atypical-travel.asciidoc |   3 +-
 ...65-portal-login-impossible-travel.asciidoc |   3 +-
 ...-high-malicious-probability-score.asciidoc |   3 +-
 ...a-low-malicious-probability-score.asciidoc |   3 +-
 ...-activation-for-okta-user-account.asciidoc |   5 +-
 ...lobal-administrator-role-assigned.asciidoc |   3 +-
 ...-grant-via-registered-application.asciidoc |   3 +-
 ...ing-via-visual-studio-code-client.asciidoc |   3 +-
 ...-grant-via-registered-application.asciidoc |   3 +-
 ...user-reported-suspicious-activity.asciidoc |   3 +-
 ...ker-spawning-suspicious-processes.asciidoc |   8 +-
 ...irst-occurrence-of-client-request.asciidoc |   3 +-
 ...nt-console-file-from-unusual-path.asciidoc |  14 +-
 ...tion-of-wdigest-security-provider.asciidoc |  25 +-
 ...otection-alerts-by-user-principal.asciidoc |   3 +-
 ...-device-token-hash-behind-a-proxy.asciidoc |   3 +-
 ...-to-a-suspicious-top-level-domain.asciidoc |   6 +-
 ...ign-in-events-via-third-party-idp.asciidoc |   3 +-
 ...k-home-page-registry-modification.asciidoc |   4 +-
 ...tial-credential-access-via-dcsync.asciidoc |  39 +-
 ...tial-access-via-windows-utilities.asciidoc |   6 +-
 ...ng-via-trusted-microsoft-programs.asciidoc |  53 ++-
 ...e-download-via-a-headless-browser.asciidoc |  13 +-
 ...re-driven-ssh-brute-force-attempt.asciidoc |  11 +-
 ...ication-of-accessibility-binaries.asciidoc |   6 +-
 ...fa-bombing-via-push-notifications.asciidoc |  46 ++-
 ...ng-activity-from-compromised-host.asciidoc |  18 +-
 ...ershell-hacktool-script-by-author.asciidoc |   9 +-
 ...hacktool-script-by-function-names.asciidoc |   4 +-
 ...ege-escalation-via-cve-2022-38028.asciidoc |  10 +-
 ...h-count-of-readme-files-by-system.asciidoc |   6 +-
 ...remote-desktop-shadowing-activity.asciidoc |  17 +-
 ...ng-activity-from-compromised-host.asciidoc |  13 +-
 ...m-tampering-via-file-modification.asciidoc |   4 +-
 ...fa-bombing-via-push-notifications.asciidoc | 141 +++++++
 ...owershell-kerberos-ticket-request.asciidoc |   6 +-
 ...ershell-mailbox-collection-script.asciidoc |  29 +-
 ...ord-policy-discovery-capabilities.asciidoc |  16 +-
 ...s-defender-tampering-capabilities.asciidoc |  63 +++-
 ...wershell-share-enumeration-script.asciidoc |   6 +-
 ...t-with-audio-capture-capabilities.asciidoc |   6 +-
 ...-clipboard-retrieval-capabilities.asciidoc |   4 +-
 ...n-via-windir-environment-variable.asciidoc |   4 +-
 .../remote-execution-via-file-shares.asciidoc |  63 ++--
 ...mote-file-download-via-powershell.asciidoc |  35 +-
 ...ver-spawning-suspicious-processes.asciidoc |   4 +-
 ...ation-from-unusual-ssh-public-key.asciidoc |   3 +-
 ...picious-access-to-ldap-attributes.asciidoc |   6 +-
 ...y-application-via-microsoft-graph.asciidoc |   3 +-
 ...picious-execution-from-inet-cache.asciidoc |  18 +-
 ...oft-antimalware-service-execution.asciidoc | 144 +++++++
 ...soft-diagnostics-wizard-execution.asciidoc |   5 +-
 ...startup-shell-folder-modification.asciidoc |   6 +-
 .../system-file-ownership-change.asciidoc     | 131 +++++++
 ...public-ip-discovery-via-dns-query.asciidoc |   8 +-
 .../untrusted-driver-loaded.asciidoc          |   4 +-
 ...ess-from-a-system-virtual-process.asciidoc |   4 +-
 .../unusual-child-process-of-dns-exe.asciidoc |  14 +-
 ...-execution-from-web-server-parent.asciidoc |  20 +-
 ...via-microsoft-common-console-file.asciidoc |  31 +-
 ...unusual-file-operation-by-dns-exe.asciidoc |  71 ++++
 ...al-file-transfer-utility-launched.asciidoc |   6 +-
 ...ss-spawned-from-web-server-parent.asciidoc |  48 ++-
 ...-account-exposed-to-kerberoasting.asciidoc |   6 +-
 ...ess-child-of-common-web-processes.asciidoc |  31 +-
 ...r-exclusions-added-via-powershell.asciidoc |   4 +-
 ...-firewall-disabled-via-powershell.asciidoc |   4 +-
 ...e-installed-via-an-unusual-client.asciidoc |  10 +-
 docs/index.asciidoc                           |   2 +
 209 files changed, 18172 insertions(+), 704 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-bypass-uac-via-event-viewer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-console-history.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-event-logs.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-component-object-model-hijacking.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-crowdstrike-external-alerts.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-d-bus-service-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-iis-http-logging-disabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-lsass-memory-dump-handle-access.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-atypical-travel.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-impossible-travel.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-modification-of-wdigest-security-provider.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-outlook-home-page-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-dcsync.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-kerberos-ticket-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-mailbox-collection-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-share-enumeration-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-execution-via-file-shares.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-file-download-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-file-ownership-change.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-untrusted-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-sns-rare-protocol-subscription-by-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-sns-topic-message-publish-by-rare-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/aws-ssm-session-started-to-ec2-instance.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-antimalware-service-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/system-file-ownership-change.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-file-operation-by-dns-exe.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses.asciidoc
new file mode 100644
index 0000000000..048286fd1b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses.asciidoc
@@ -0,0 +1,212 @@
+[[prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses]]
+=== AWS Access Token Used from Multiple Addresses
+
+This rule identifies potentially suspicious activity by detecting instances where a single IAM user's temporary session token is accessed from multiple IP addresses within a short time frame. Such behavior may suggest that an adversary has compromised temporary credentials and is utilizing them from various locations. To enhance detection accuracy and minimize false positives, the rule incorporates criteria that evaluate unique IP addresses, user agents, cities, and networks. These additional checks help distinguish between legitimate distributed access patterns and potential credential misuse. Detected activities are classified into different types based on the combination of unique indicators, with each classification assigned a fidelity score reflecting the likelihood of malicious behavior. High fidelity scores are given to patterns most indicative of threats, such as multiple unique IPs, networks, cities, and user agents. Medium and low fidelity scores correspond to less severe patterns, enabling security teams to effectively prioritize alerts.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-32m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.sygnia.co/blog/sygnia-investigation-bybit-hack/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS IAM
+* Data Source: AWS CloudTrail
+* Tactic: Initial Access
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS Access Token Used from Multiple Addresses*
+
+
+Access tokens are bound to a single user. Usage from multiple IP addresses may indicate the token was stolen and used elsewhere. By correlating this with additional detection criteria like multiple user agents, different cities, and different networks, we can improve the fidelity of the rule and help to eliminate false positives associated with expected behavior, like dual-stack IPV4/IPV6 usage.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the IAM User**: Examine the `aws.cloudtrail.user_identity.arn` stored in `user_id` and correlate with the `source.ips` stored in `ip_list` and `unique_ips` count to determine how widely the token was used.
+- **Correlate Additional Detection Context**: Examine `activity_type` and `fidelity_score` to determine additional cities, networks or user agents associated with the token usage.
+- **Determine Access Key Type**: Examine the `access_key_id` to determine whether the token is short-term (beginning with ASIA) or long-term (beginning with AKIA).
+- **Check Recent MFA Events**: Determine whether the user recently enabled MFA, registered devices, or assumed a role using this token.
+- **Review Workload Context**: Confirm whether the user was expected to be active across multiple cities, networks or user agent environments.
+- **Trace Adversary Movement**: Pivot to related actions (e.g., `s3:ListBuckets`, `iam:ListUsers`, `sts:GetCallerIdentity`) to track further enumeration.
+
+
+*False Positive Analysis*
+
+
+- Automation frameworks that rotate through multiple IPs or cloud functions with dynamic egress IPs may cause this alert to fire.
+- Confirm geolocation and workload context before escalating.
+
+
+*Response and Remediation*
+
+
+- **Revoke the Token**: Disable or rotate the IAM credentials and invalidate the temporary session token.
+- **Audit the Environment**: Look for signs of lateral movement or data access during the token's validity.
+- **Strengthen Controls**: Require MFA for high-privilege actions, restrict access via policy conditions (e.g., IP range or device).
+
+
+*References*
+
+
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html[IAM Long-Term Credentials]
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html[STS Temporary Credentials]
+- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html[Using MFA with Temporary Credentials]
+- https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html[AWS Threat Detection Use Cases]
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-aws.cloudtrail* metadata _id, _version, _index
+| where @timestamp > now() - 30 minutes
+  and event.dataset == "aws.cloudtrail"
+  and aws.cloudtrail.user_identity.arn is not null
+  and aws.cloudtrail.user_identity.type == "IAMUser"
+  and source.ip is not null
+  and aws.cloudtrail.user_identity.access_key_id is not null
+  and not (
+    user_agent.original like "*Terraform*" or
+    user_agent.original like "*Ansible*" or
+    user_agent.original like "*Pulumi*"
+  )
+  and `source.as.organization.name` != "AMAZON-AES"
+  and not ((
+    `source.as.organization.name` == "AMAZON-02" and aws.cloudtrail.event_category == "Data"))
+  and event.provider not in (
+    "health.amazonaws.com", "monitoring.amazonaws.com", "notifications.amazonaws.com",
+    "ce.amazonaws.com", "cost-optimization-hub.amazonaws.com",
+    "servicecatalog-appregistry.amazonaws.com", "securityhub.amazonaws.com", 
+    "account.amazonaws.com", "budgets.amazonaws.com", "freetier.amazonaws.com"
+  )
+
+| eval
+  Esql.time_window_date_trunc = date_trunc(30 minutes, @timestamp),
+  Esql.aws_cloudtrail_user_identity_arn = aws.cloudtrail.user_identity.arn,
+  Esql.aws_cloudtrail_user_identity_access_key_id = aws.cloudtrail.user_identity.access_key_id,
+  Esql.source_ip = source.ip,
+  Esql.user_agent_original = user_agent.original,
+  Esql.source_ip_string = to_string(source.ip),
+  Esql.source_ip_user_agent_pair = concat(Esql.source_ip_string, " - ", user_agent.original),
+  Esql.source_ip_city_pair = concat(Esql.source_ip_string, " - ", source.geo.city_name),
+  Esql.source_geo_city_name = source.geo.city_name,
+  Esql.source_network_org_name = `source.as.organization.name`,
+  Esql.source_ip_network_pair = concat(Esql.source_ip_string, "-", `source.as.organization.name`),
+  Esql.event_timestamp = @timestamp
+
+| stats
+  Esql.event_action_values = values(event.action),
+  Esql.event_provider_values = values(event.provider),
+  Esql.aws_cloudtrail_user_identity_access_key_id_values = values(Esql.aws_cloudtrail_user_identity_access_key_id),
+  Esql.aws_cloudtrail_user_identity_arn_values = values(Esql.aws_cloudtrail_user_identity_arn),
+  Esql.source_ip_values = values(Esql.source_ip),
+  Esql.user_agent_original_values = values(Esql.user_agent_original),
+  Esql.source_ip_user_agent_pair_values = values(Esql.source_ip_user_agent_pair),
+  Esql.source_geo_city_name_values = values(Esql.source_geo_city_name),
+  Esql.source_ip_city_pair_values = values(Esql.source_ip_city_pair),
+  Esql.source_network_org_name_values = values(Esql.source_network_org_name),
+  Esql.source_ip_network_pair_values = values(Esql.source_ip_network_pair),
+  Esql.source_ip_count_distinct = count_distinct(Esql.source_ip),
+  Esql.user_agent_original_count_distinct = count_distinct(Esql.user_agent_original),
+  Esql.source_geo_city_name_count_distinct = count_distinct(Esql.source_geo_city_name),
+  Esql.source_network_org_name_count_distinct = count_distinct(Esql.source_network_org_name),
+  Esql.timestamp_first_seen = min(Esql.event_timestamp),
+  Esql.timestamp_last_seen = max(Esql.event_timestamp),
+  Esql.event_count = count()
+  by Esql.time_window_date_trunc, Esql.aws_cloudtrail_user_identity_access_key_id
+
+| eval
+  Esql.activity_type = case(
+    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2 and Esql.user_agent_original_count_distinct >= 2, "multiple_ip_network_city_user_agent",
+    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2, "multiple_ip_network_city",
+    Esql.source_ip_count_distinct >= 2 and Esql.source_geo_city_name_count_distinct >= 2, "multiple_ip_and_city",
+    Esql.source_ip_count_distinct >= 2 and Esql.source_network_org_name_count_distinct >= 2, "multiple_ip_and_network",
+    Esql.source_ip_count_distinct >= 2 and Esql.user_agent_original_count_distinct >= 2, "multiple_ip_and_user_agent",
+    "normal_activity"
+  ),
+  Esql.activity_fidelity_score = case(
+    Esql.activity_type == "multiple_ip_network_city_user_agent", "high",
+    Esql.activity_type == "multiple_ip_network_city", "high",
+    Esql.activity_type == "multiple_ip_and_city", "medium",
+    Esql.activity_type == "multiple_ip_and_network", "medium",
+    Esql.activity_type == "multiple_ip_and_user_agent", "low"
+  )
+
+| keep
+  Esql.time_window_date_trunc,
+  Esql.activity_type,
+  Esql.activity_fidelity_score,
+  Esql.event_count,
+  Esql.timestamp_first_seen,
+  Esql.timestamp_last_seen,
+  Esql.aws_cloudtrail_user_identity_arn_values,
+  Esql.aws_cloudtrail_user_identity_access_key_id_values,
+  Esql.event_action_values,
+  Esql.event_provider_values,
+  Esql.source_ip_values,
+  Esql.user_agent_original_values,
+  Esql.source_ip_user_agent_pair_values,
+  Esql.source_geo_city_name_values,
+  Esql.source_ip_city_pair_values,
+  Esql.source_network_org_name_values,
+  Esql.source_ip_network_pair_values,
+  Esql.source_ip_count_distinct,
+  Esql.user_agent_original_count_distinct,
+  Esql.source_geo_city_name_count_distinct,
+  Esql.source_network_org_name_count_distinct
+
+| where Esql.activity_type != "normal_activity"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user.asciidoc
new file mode 100644
index 0000000000..99222c08f1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user]]
+=== AWS DynamoDB Scan by Unusual User
+
+Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Scan.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS DynamoDB
+* Resources: Investigation Guide
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS DynamoDB Scan by Unusual User*
+
+
+This rule identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time.
+
+
+*Possible Investigation Steps*
+
+
+- Identify the Actor: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
+- Review the Source IP: Check the `source.ip` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
+- Analyze the Request Parameters: Examine the `aws.cloudtrail.request_parameters` field to understand the details of the Scan request. Look for any unusual parameters or patterns that may indicate malicious intent. This also details the DynamoDB table being scanned.
+- Review Access Key: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify the access key used for the request. Determine if this key is associated with a legitimate user or if it has been compromised.
+
+
+
+*False Positive Analysis*
+
+
+- Historical User Actions: If the user has a history of scanning DynamoDB tables for legitimate purposes, this may not be a false positive. Review the user's activity logs to determine if this behavior is consistent with their normal actions.
+- Automated Processes: Some automated processes or applications may perform scans on DynamoDB tables as part of their functionality. If the user is associated with such a process, this may not be a false positive.
+
+
+*Response and Remediation*
+
+
+- Immediate Review and Reversal: If the Scan action is determined to be unauthorized, immediately revoke the user's access to the DynamoDB table and any associated resources. This may involve disabling the user's account or removing their permissions.
+- Investigate Compromise: If the Scan action is determined to be malicious, investigate the source of the request and any potential compromise of the user's account. This may involve reviewing access logs, resetting passwords, and enabling multi-factor authentication (MFA) for the affected user. If export options were used with the CLI or SDK, they may have been saved locally or to a remote location.
+- Review IAM Policies: Review the IAM policies associated with the user to ensure that they have the appropriate permissions for their role. If necessary, update the policies to restrict access to sensitive resources.
+- Monitor for Future Activity: Continue to monitor the user's activity for any further suspicious behavior. Set up additional alerts or logging to detect any future unauthorized access attempts.
+
+
+*Additional Information*
+
+
+For further guidance on managing and securing DynamoDB in AWS environments, refer to the https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html[AWS DynamoDB documentation] and AWS best practices for security.
+
+
+==== Setup
+
+
+DynamoDB data events must be enabled in CloudTrail to capture the Scan action. Ensure that the AWS CloudTrail service is configured to log data events for DynamoDB tables.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "dynamodb.amazonaws.com"
+    and event.action: "Scan"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Cloud Storage
+** ID: T1530
+** Reference URL: https://attack.mitre.org/techniques/T1530/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3.asciidoc
new file mode 100644
index 0000000000..2b7f265e28
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3]]
+=== AWS DynamoDB Table Exported to S3
+
+Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_ExportTableToPointInTime.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS DynamoDB
+* Resources: Investigation Guide
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+
+*Investigating AWS DynamoDB Table Exported to S3*
+
+
+This rule identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs.
+
+This is a New Terms rule that only flags when this behavior is observed for the first time.
+
+
+*Possible Investigation Steps*
+
+- Identify the Actor: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the export. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
+- Review the Source IP: Check the `source.ip` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
+- Review Access Key: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify the access key used for the request. Determine if this key has been compromised.
+- Analyze the Request Parameters: Examine the `aws.cloudtrail.request_parameters` field to understand the details of the ExportTableToPointInTime request. Look for any unusual parameters or patterns that may indicate malicious intent. This also details the DynamoDB table being exported.
+
+
+*False Positive Analysis*
+
+- Historical User Actions: If the user has a history of exporting DynamoDB tables for legitimate purposes, this may be a false positive. Review the user's activity logs to determine if this behavior is consistent with their normal actions.
+- Automated Processes: Some automated processes or applications may perform exports on DynamoDB tables as part of their functionality. If the user is associated with such a process, this may be a false positive.
+
+
+*Response and Remediation*
+
+- Immediate Review and Reversal: If the ExportTableToPointInTime action is determined to be unauthorized, immediately revoke the user's access to the DynamoDB table and any associated resources. This may involve disabling the user's access keys or removing their permissions.
+- Investigate Compromise: If the ExportTableToPointInTime action is determined to be malicious, investigate the source and destination of the request and any potential compromise of the user's account. If the destination S3 bucket is not known, it may be a sign of data exfiltration and may require incident response.
+- Review IAM Policies: Review the IAM policies associated with the user to ensure that they have the appropriate permissions for their role. If necessary, update the policies to restrict access to sensitive resources.
+- Monitor for Future Activity: Continue to monitor the user's activity for any further suspicious behavior. Set up additional alerts or logging to detect any future unauthorized access attempts.
+
+
+*Additional Information*
+
+
+For further guidance on managing and securing DynamoDB in AWS environments, refer to the https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html[AWS DynamoDB documentation] and AWS best practices for security.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "dynamodb.amazonaws.com"
+    and event.action: "ExportTableToPointInTime"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Sub-technique:
+** Name: Exfiltration to Cloud Storage
+** ID: T1567.002
+** Reference URL: https://attack.mitre.org/techniques/T1567/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
new file mode 100644
index 0000000000..039fbab569
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded]]
+=== AWS EC2 Instance Connect SSH Public Key Uploaded
+
+Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques
+* https://medium.parttimepolymath.net/aws-ec2-instance-connect-a-very-neat-trick-4d2fc0c28010
+* https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/
+* https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc
+* https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html
+* https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS EC2
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS EC2 Instance Connect SSH Public Key Uploaded*
+
+
+This rule detects when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. Adversaries may upload SSH public keys to EC2 instances to maintain access to the instance or for initial access. This action also occurs automatically in the background when establishing a connection to an instance via the same service.  The rule covers cases where the `SendSerialConsoleSSHPublicKey` API action is used to upload an SSH public key to a serial connection, which can be exploited for privilege escalation.
+
+
+*Possible Investigation Steps:*
+
+
+- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions.
+- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the SSH public key upload. Look for any unusual parameters that could suggest unauthorized or malicious modifications. Use the `target.entity.id` field to determine the targeted EC2 instance.
+- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
+- **Contextualize with Timestamp**: Use the `@timestamp` field to check when the SSH public key was uploaded. Changes during non-business hours or outside regular maintenance windows might require further scrutiny.
+- **Correlate with Other Activities**: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
+- **Check for Serial Console Access**: If the `SendSerialConsoleSSHPublicKey` action was used, verify if the `ec2:EnableSerialConsoleAccess` permission was also used, which might indicate an attempt to enable and exploit the serial console.
+
+
+*False Positive Analysis:*
+
+
+- **Legitimate Administrative Actions**: Confirm if the SSH public key upload aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
+- **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
+
+
+
+*Response and Remediation:*
+
+
+- **Immediate Review and Reversal if Necessary**: If the upload was unauthorized, remove the uploaded SSH public key from the EC2 instance and review the instance's access logs for any suspicious activity.
+- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar actions, especially those involving sensitive instances or unusual file extensions.
+- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning SSH key management and the risks of unauthorized key uploads.
+- **Audit EC2 Instance Policies and Permissions**: Conduct a comprehensive audit of all EC2 instance policies and associated permissions to ensure they adhere to the principle of least privilege.
+- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
+
+
+*Additional Information:*
+
+
+For further guidance on managing EC2 instances and securing AWS environments, refer to the https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html[AWS EC2 Instance Connect documentation] and AWS best practices for security. Additionally, consult the following resources for specific details on SSH key management and privilege escalation techniques:
+- https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/[Stratus Red Team - AWS EC2 Instance Connect]
+- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc[HackTricks - AWS EC2 Privilege Escalation]
+- https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html[AWS EC2 Instance Connect API Reference]
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: aws.cloudtrail
+    and event.provider: ec2-instance-connect.amazonaws.com
+    and event.action: (SendSSHPublicKey or SendSerialConsoleSSHPublicKey)
+    and event.outcome: success
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: SSH Authorized Keys
+** ID: T1098.004
+** Reference URL: https://attack.mitre.org/techniques/T1098/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-created.asciidoc
new file mode 100644
index 0000000000..7017ce1bc4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-created.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-18-14-aws-ec2-route-table-created]]
+=== AWS EC2 Route Table Created
+
+Identifies when an EC2 Route Table has been created. Route tables can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS EC2
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating AWS EC2 Route Table Created*
+
+
+AWS Route Tables are crucial components in managing network traffic within AWS environments, directing data between subnets and internet gateways. Adversaries may exploit route tables to reroute traffic for data exfiltration or to establish persistence by creating unauthorized routes. The detection rule monitors successful creation events of route tables, flagging potential misuse by correlating specific AWS CloudTrail logs, thus aiding in identifying unauthorized network configuration changes.
+
+
+*Possible investigation steps*
+
+
+- Investigate the AWS account and IAM user or role to determine if the action aligns with expected behavior and permissions.
+- Examine the newly created route table's configuration to identify any unauthorized or suspicious routes that could indicate potential misuse or data exfiltration attempts.
+- Correlate the event with other network security monitoring data to identify any unusual traffic patterns or anomalies that coincide with the route table creation.
+- Assess the environment for any recent changes or incidents that might explain the creation of the route table, such as new deployments or infrastructure modifications.
+
+
+*False positive analysis*
+
+
+- Routine infrastructure updates or deployments may trigger route table creation events. To manage this, establish a baseline of expected behavior during scheduled maintenance windows and exclude these from alerts.
+- Automated cloud management tools often create route tables as part of their operations. Identify these tools and create exceptions for their known activities to reduce noise.
+- Development and testing environments frequently undergo changes, including the creation of route tables. Consider excluding these environments from alerts or applying a different set of monitoring rules.
+- Legitimate changes by authorized personnel can be mistaken for suspicious activity. Implement a process to verify and document authorized changes, allowing for quick exclusion of these events from alerts.
+- Multi-account AWS setups might have centralized networking teams that create route tables across accounts. Coordinate with these teams to understand their activities and exclude them from triggering alerts.
+
+
+*Response and remediation*
+
+
+- If unauthorized, remove permissions for related actions from the user or role. You can use the managed https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html[AWSDenyAll] policy. 
+- Review the newly created route table and any associated routes to identify unauthorized entries. Remove any routes that are not part of the expected network configuration.
+- Conduct a thorough audit of IAM roles and permissions to ensure that only authorized users have the ability to create or modify route tables. Revoke any excessive permissions identified.
+- Implement network monitoring to detect unusual traffic patterns that may indicate data exfiltration or other malicious activities.
+- Escalate the incident to the security operations team for further investigation and to determine if additional AWS resources have been compromised.
+- Review AWS CloudTrail logs for any other suspicious activities around the time of the route table creation to identify potential indicators of compromise.
+- Update security policies and procedures to include specific guidelines for monitoring and responding to unauthorized route table modifications, ensuring rapid detection and response in the future.
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "ec2.amazonaws.com" 
+    and event.action:(
+        "CreateRoute" or 
+        "CreateRouteTable"
+    ) 
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted.asciidoc
new file mode 100644
index 0000000000..b5ecce155a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted]]
+=== AWS EC2 Route Table Modified or Deleted
+
+Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/easttimor/aws-incident-response#network-routing
+* https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRoute.html
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReplaceRouteTableAssociation
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS EC2
+* Use Case: Network Security Monitoring
+* Resources: Investigation Guide
+* Tactic: Persistence
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS EC2 Route Table Modified or Deleted*
+
+
+This rule detects modifications or deletions of AWS route tables using actions such as `ReplaceRoute`, `ReplaceRouteTableAssociation`, `DeleteRouteTable`, `DeleteRoute`, or `DisassociateRouteTable`. These actions may indicate legitimate administrative activity, but they can also be abused by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment.
+
+
+*Possible Investigation Steps*
+
+
+- **Review Request Parameters:**
+   - Check the `aws.cloudtrail.request_parameters` field. The sub-fields may vary depending on the `event.action` (e.g., `routeTableId` for `DeleteRouteTable`, `destinationCidrBlock` for `ReplaceRoute`).
+   - Validate the affected route table, routes, or associations based on the API call:
+     - For `ReplaceRoute`: Look for changes in specific routes using `destinationCidrBlock`.
+     - For `ReplaceRouteTableAssociation`: Review the new association details (e.g., subnet ID).
+     - For `DeleteRouteTable`: Confirm the `routeTableId` of the deleted table.
+     - For `DisassociateRouteTable`: Verify the disassociated resources.
+
+- **Review User Context**:
+  - **User Identity**: Inspect the `aws.cloudtrail.user_identity.arn` field to determine the user or role initiating the action. Investigate whether this user is authorized to perform these operations.
+  - **Access Key ID**: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify if the access key used was expected or potentially compromised.
+  - **Access Patterns**: Validate whether the user or role has a history of performing route table modifications and whether this aligns with their expected responsibilities.
+
+- **Analyze Request Details**:
+  - **Action Type**: Verify the specific API call in the `event.action` field (e.g., `ReplaceRoute`, `DeleteRouteTable`) to understand the nature of the modification.
+  - **Source IP and Geolocation**: Examine the `source.ip` and `source.geo` fields to confirm whether the request originated from a trusted location. Suspicious geolocations or IPs may indicate adversarial activity.
+  - **User Agent**: Review the `user_agent.original` field to determine the tool used for the request (e.g., AWS CLI, Terraform). Unusual or custom user agents may indicate malicious intent.
+
+- **Correlate with Other Activity**:
+  - **Concurrent API Calls**: Look for related API calls (e.g., `CreateRoute`, `AuthorizeSecurityGroupIngress`, or `ModifyInstanceAttribute`) from the same user or IP to detect broader attack patterns.
+  - **IAM Changes**: Investigate whether any IAM policy updates or privilege escalation attempts preceded this activity.
+  - **Unusual Volume of Changes**: Check if the user has performed multiple route table modifications or deletions in a short timeframe.
+
+- **Validate the Intent**:
+  - **Planned Changes**: Confirm with administrators whether the route table changes were part of a planned update or maintenance activity.
+  - **Permissions and Justification**: Ensure that the user or role has the least privilege necessary for these actions and that there is a valid reason for modifying the route table.
+
+
+*False Positive Analysis*
+
+
+- **Routine Administration**: Route table modifications are often part of routine administrative tasks, such as creating new routes, updating associations, or removing unused resources.
+- **Automation Tools**: Automated workflows, such as those executed by Terraform or CloudFormation, may trigger these events. Verify whether the `user_agent.original` field or source IP matches known automation tools.
+- **Maintenance or Scaling**: Confirm whether these actions align with maintenance activities or scaling events (e.g., adding or removing subnets).
+
+
+*Response and Remediation*
+
+
+- **Revoke Unauthorized Permissions**: If unauthorized, remove permissions for related actions from the user or role. You can use the managed https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html[AWSDenyAll] policy.
+- **Restore the Route Table**:
+  - If critical networking was impacted, restore the route table or reapply previous configurations from backups or Terraform state files.
+  - Verify connectivity to affected subnets or instances to ensure no disruptions to services.
+- **Audit IAM Policies**:
+  - Limit route table modification permissions to specific trusted users, roles, or automation accounts.
+  - Implement conditions in IAM policies, such as source IP restrictions, to reduce the risk of unauthorized access.
+- **Monitor and Alert**:
+  - Set up additional alerts for unexpected route table modifications or deletions.
+  - Use VPC flow logs and CloudTrail to monitor for related suspicious activity.
+- **Secure Automation**: Ensure automation tools, such as Terraform or CloudFormation, are configured securely and that their credentials are stored in secure locations like AWS Secrets Manager.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "ec2.amazonaws.com"
+    and event.action:(
+        "ReplaceRoute" or
+        "ReplaceRouteTableAssociation" or
+        "DeleteRouteTable" or
+        "DeleteRoute" or
+        "DisassociateRouteTable"
+    )
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
new file mode 100644
index 0000000000..0c1a8e6478
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
@@ -0,0 +1,133 @@
+[[prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance]]
+=== AWS IAM Create User via Assumed Role on EC2 Instance
+
+Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html
+* https://www.dionach.com/en-us/breaking-into-the-cloud-red-team-tactics-for-aws-compromise/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS IAM
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM Create User via Assumed Role on EC2 Instance*
+
+
+This rule detects when an AWS Identity and Access Management (IAM) user is created through an assumed role on an EC2 instance. This action may indicate a potentially compromised instance where an adversary could be using the instance’s permissions to create a new IAM user, enabling persistent unauthorized access.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Assumed Role and Initiating Instance**:
+  - **Role and Instance**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the specific EC2 instance and role used for this action (e.g., `arn:aws:sts::[account-id]:assumed-role/[role-name]/[instance-id]`). Verify if this behavior aligns with expected usage or represents an anomaly.
+
+- **Analyze the Target IAM User**:
+  - **New User Details**: Inspect `aws.cloudtrail.request_parameters` to see the username that was created. Validate if the user is expected or authorized.
+  - **Review Creation Time and Context**: Compare the creation time (`@timestamp`) of the user with other activities from the same instance and role to assess if this creation was part of a larger chain of actions.
+
+- **Check User Agent and Tooling**:
+  - **User Agent Analysis**: Review `user_agent.original` to see if AWS CLI, SDK, or other tooling was used for this request. Identifiers such as `aws-cli`, `boto3`, or similar SDK names can indicate the method used, which may differentiate automation from interactive actions.
+  - **Source IP and Location**: Use the `source.ip` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.
+
+- **Evaluate for Persistence Indicators**:
+  - **Role Permissions**: Check the permissions associated with the assumed role (`arn:aws:iam::[account-id]:role/[role-name]`) to determine if creating IAM users is a legitimate activity for this role.
+  - **Automated Role Patterns**: If the assumed role or instance typically creates IAM users for automation purposes, validate this action against historical records to confirm if the event is consistent with normal patterns.
+
+- **Review Related CloudTrail Events**:
+  - **Additional IAM Actions**: Investigate for other recent IAM or CloudTrail events tied to this role or instance, especially `CreateAccessKey` or `AttachUserPolicy` actions. These could signal further attempts to empower or utilize the newly created user.
+  - **Correlate with Other Suspicious Activities**: Determine if other roles or instances recently initiated similar unusual actions, such as privilege escalations or data access.
+
+
+*False Positive Analysis*
+
+
+- **Expected Automation**: Assumed roles may be used by legitimate automated systems that create users for specific workflows. Confirm if this event aligns with known automation activities.
+- **Role Exceptions**: If this action is routine for specific roles, consider adding those roles to a monitored exception list for streamlined review.
+
+
+*Response and Remediation*
+
+
+- **Immediate Access Review**: If user creation was unauthorized, restrict the assumed role’s permissions to prevent further user creation.
+- **Delete Unauthorized Users**: Confirm and remove any unauthorized IAM users, adjusting IAM policies to reduce similar risks.
+- **Enhance Monitoring and Alerts**: Enable enhanced logging or real-time alerts for this role or instance to detect further unauthorized access attempts.
+- **Policy Update**: Consider updating IAM policies associated with roles on EC2 instances to limit sensitive actions like IAM user creation.
+
+
+*Additional Information*
+
+
+For further guidance on managing IAM roles and permissions within AWS environments, refer to the https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html[AWS IAM documentation] and AWS best practices for security.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "iam.amazonaws.com"
+    and event.action: "CreateUser"
+    and event.outcome: "success"
+    and aws.cloudtrail.user_identity.type: "AssumedRole"
+    and user.id: *\:i-*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
new file mode 100644
index 0000000000..f8caf36e6d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
@@ -0,0 +1,131 @@
+[[prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user]]
+=== AWS IAM Customer-Managed Policy Attached to Role by Rare User
+
+Detects when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user. Customer-managed policies are policies created and controlled within an AWS account, granting specific permissions to roles or users when attached. This rule identifies potential privilege escalation by flagging cases where a customer-managed policy is attached to a role by an unexpected actor, which could signal unauthorized access or misuse. Attackers may attach policies to roles to expand permissions and elevate their privileges within the AWS environment. This is a New Terms rule that uses the "cloud.account.id", "user.name" and "target.entity.id" fields to check if the combination of the actor identity and target role name has not been seen before.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS IAM
+* Resources: Investigation Guide
+* Use Case: Identity and Access Audit
+* Tactic: Privilege Escalation
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS IAM Customer-Managed Policy Attached to Role by Rare User*
+
+
+This rule detects when a customer-managed IAM policy is attached to a role by an unusual or unauthorized user. This activity may indicate a potential privilege escalation attempt within the AWS environment. Adversaries could attach policies to roles to expand permissions, thereby increasing their capabilities and achieving elevated access.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Initiating User and Target Role**:
+  - **User Identity**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the user who initiated the policy attachment. Confirm if this user typically has permissions to modify IAM roles and if their activity is consistent with their usual responsibilities.
+  - **Target Role**: Review `target.entity.id` to identify the role to which the policy was attached. Assess whether modifying this role is expected for this user or if this action is unusual in your environment.
+
+- **Analyze the Attached Policy**:
+  - **Policy ARN**: Inspect the `aws.cloudtrail.request_parameters` field to identify the specific customer-managed policy attached to the role. Evaluate if this policy grants sensitive permissions, especially permissions that could enable privileged actions or data access.
+  - **Policy Permissions**: Examine the policy content to determine the scope of permissions granted. Policies enabling actions like `s3:*`, `ec2:*`, or `iam:*` could be leveraged for broader access, persistence, or lateral movement.
+
+- **Review Source and User Agent Details**:
+  - **Source IP and Location**: Analyze the `source.ip` and `source.geo` fields to confirm the IP address and geographic location where the policy attachment originated. Verify if this matches expected locations for the initiating user.
+  - **User Agent Analysis**: Examine `user_agent.original` to determine if AWS CLI, SDK, or other tooling was used to perform this action. Tool identifiers like `aws-cli` or `boto3` may indicate automation, while others may suggest interactive sessions.
+
+- **Evaluate Anomalous Behavior Patterns**:
+  - **User’s Historical Activity**: Check if the initiating user has a history of attaching policies to roles. An unusual pattern in policy attachments could indicate suspicious behavior, especially if the user lacks authorization.
+  - **Role Modification History**: Investigate if the targeted role is frequently modified by this or other users. Repeated, unauthorized modifications to a role could signal an attempt to maintain elevated access.
+
+- **Correlate with Related CloudTrail Events**:
+  - **Other IAM or CloudTrail Activities**: Look for recent actions associated with the same user or role by reviewing `event.action` and `event.provider` to identify which AWS services were accessed. This may provide context on the user’s intent or additional actions taken.
+  - **Broader Suspicious Patterns**: Identify if similar anomalous events have recently occurred, potentially suggesting a coordinated or escalating attack pattern within the AWS account.
+
+
+*False Positive Analysis*
+
+
+- **Authorized Administrative Actions**: IAM administrators may legitimately attach policies to roles as part of routine role management. Verify if the user is authorized and if the activity aligns with expected administrative tasks.
+- **Role-Specific Modifications**: Roles that frequently undergo policy updates may trigger this rule during standard operations. Consider monitoring for patterns or establishing known exceptions for specific users or roles where appropriate.
+
+
+*Response and Remediation*
+
+
+- **Immediate Access Review**: If the policy attachment is unauthorized, consider detaching the policy and reviewing the permissions granted to the initiating user.
+- **Restrict Role Modification Permissions**: Limit which users or roles can attach policies to critical IAM roles. Apply least privilege principles to reduce the risk of unauthorized policy changes.
+- **Enhance Monitoring and Alerts**: Enable real-time alerts and monitoring on IAM policy modifications to detect similar actions promptly.
+- **Regular Policy Audits**: Conduct periodic audits of IAM policies and role permissions to ensure that unauthorized changes are quickly identified and addressed.
+
+
+*Additional Information*
+
+
+For more information on managing IAM policies and roles in AWS environments, refer to the https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html[AWS IAM Documentation] and AWS security best practices.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "iam.amazonaws.com"
+    and event.action: "AttachRolePolicy"
+    and event.outcome: "success"
+    and not related.entity: arn\:aws\:iam\:\:aws\:policy*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Temporary Elevated Cloud Access
+** ID: T1548.005
+** Reference URL: https://attack.mitre.org/techniques/T1548/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
new file mode 100644
index 0000000000..4e270038ef
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
@@ -0,0 +1,182 @@
+[[prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source]]
+=== AWS S3 Unauthenticated Bucket Access by Rare Source
+
+Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify --no-sign-request in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a New Terms rule, which means it will trigger for each unique combination of the source.address and targeted bucket name that has not been seen making this API request.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: Amazon S3
+* Use Case: Asset Visibility
+* Resources: Investigation Guide
+* Tactic: Collection
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating AWS S3 Unauthenticated Bucket Access by Rare Source*
+
+
+This rule detects requests to an AWS S3 bucket by an unauthenticated source, which could indicate a misconfigured bucket policy allowing public access. Adversaries can exploit this misconfiguration by using tools or AWS CLI options like `--no-sign-request` to access bucket contents.
+
+The rule triggers when an unauthenticated IP address retrieves an object, and that IP has not been seen in the last 7 days.
+
+
+*Possible Investigation Steps*
+
+
+1. **Identify the Source of the Request**:
+    - Review the `source.address` field to determine the IP address of the request source.
+    - Check `source.geo` fields for geographic details of the originating IP address.
+    - Analyze the `user_agent.original` field to identify the client or tool used (e.g., `Python Requests`, `aws-cli`, browser).
+
+2. **Review the Accessed Bucket and Object**:
+    - Analyze the `aws.cloudtrail.resources.arn` field to identify the S3 bucket and object being accessed.
+    - Inspect `aws.cloudtrail.request_parameters` for bucket name and object key to determine which file was retrieved.
+    - Review the `even.action` field to identify which API call was made (e.g., `GetObject`, `ListObjects`, `PutObject`, `ListBucket`).
+
+3. **Validate the Source IP and Context**:
+    - Determine if the IP address (`source.address`) has any prior activity in your environment.
+    - Correlate the IP with threat intelligence or blocklist databases to check for malicious indicators.
+    - Review CloudTrail logs for other activities originating from the same IP.
+
+4. **Analyze the S3 Bucket Configuration**:
+    - Review the S3 bucket's Access Control List (ACL) and bucket policy to check for misconfigurations allowing public or unauthenticated access.
+    - Look for overly permissive settings, such as `Principal: *` or `Effect: Allow` rules that expose the bucket.
+
+5. **Investigate Additional Activity**:
+    - Check if there are subsequent actions, such as:
+        - **Additional `GetObject` API calls**: Indicating further data exfiltration.
+        - **ListObjects requests**: Attempting to enumerate the bucket's contents.
+    - Correlate events within the same timeframe to identify related suspicious activity.
+
+6. **Assess the Data Exposed**:
+    - Identify the retrieved object(s) and analyze their content to assess potential data exposure.
+    - Determine if the file contains sensitive information, such as credentials, intellectual property, or PII.
+
+
+*False Positive Analysis*
+
+
+- **Public Buckets by Design**: Some S3 buckets may intentionally allow public access. Verify with the bucket owner if the access was expected.
+- **Automated Tools**: Security scanners or legitimate services may generate `GetObject` events to validate bucket configurations.
+
+
+*Response and Remediation*
+
+
+1. **Immediate Action**:
+    - Restrict or remove public access to the affected S3 bucket.
+    - Update the bucket policy to ensure access is restricted to trusted principals.
+    - Enable **S3 Block Public Access** settings to prevent unintended public access.
+
+2. **Monitoring and Detection**:
+    - Enable detailed logging and monitoring for all S3 bucket activities.
+    - Configure real-time alerts for unauthenticated `GetObject` or `ListObjects` events on sensitive S3 buckets.
+
+3. **Security Audits**:
+    - Regularly audit S3 bucket policies and ACLs to ensure they adhere to AWS security best practices.
+    - Use AWS tools like **Trusted Advisor** or **Access Analyzer** to identify and address misconfigurations.
+
+4. **Investigate for Data Exfiltration**:
+    - Analyze historical CloudTrail logs to determine if other sensitive files were accessed or exfiltrated.
+    - Assess the scope of the exposure and initiate further response if sensitive data was compromised.
+
+
+*Additional Resources*
+
+
+- https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-bucket-policies.html[AWS Documentation: S3 Bucket Policy Best Practices]
+- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html[AWS S3 Block Public Access]
+
+
+==== Setup
+
+
+S3 data events must be enabled in CloudTrail to capture the GetObject, PutObject, ListObjects, and DeleteObject actions. Ensure that the AWS CloudTrail service is configured to log data events for the S3 bucket you'd like to monitor.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "s3.amazonaws.com"
+    and event.action: (
+        "GetObject" or
+        "PutObject" or
+        "ListObjects" or
+        "DeleteObject" or
+        "ListBucket")
+    and event.outcome: "success"
+    and aws.cloudtrail.user_identity.type: ("AWSAccount" or "Unknown")
+    and cloud.account.id: "anonymous"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Cloud Storage
+** ID: T1530
+** Reference URL: https://attack.mitre.org/techniques/T1530/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Cloud Storage Object Discovery
+** ID: T1619
+** Reference URL: https://attack.mitre.org/techniques/T1619/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user.asciidoc
new file mode 100644
index 0000000000..92e304aa5c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user]]
+=== AWS SNS Rare Protocol Subscription by User
+
+Identifies when a use subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/sns/latest/api/API_Subscribe.html
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SNS
+* Resources: Investigation Guide
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Tactic: Collection
+* Tactic: Impact
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS SNS Rare Protocol Subscription by User*
+
+
+This rule identifies when an SNS topic is subscribed to by a rare protocol for a particular user. While subscribing to SNS topics is a common practice, adversaries may exploit this feature to collect sensitive information or exfiltrate data via an external email address, mobile number, or cross-account AWS service like Lambda.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed using a protocol for the first time.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
+- **Review the SNS Subscription Event**: Analyze the specifics of the `Subscribe` action in CloudTrail logs:
+  - **Topic**: Look at the `aws.cloudtrail.request_parameters` or `target.entity.id` field to identify the SNS topic involved in the subscription.
+  - **Protocol and Endpoint**: Review the `aws.cloudtrail.request_parameters` field to confirm the subscription's protocol and endpoint, if available. Confirm if this endpoint is associated with a known or trusted entity.
+  - **Subscription Status**: Check the `aws.cloudtrail.response_elements` field for the subscription's current status, noting if it requires confirmation.
+- **Verify Authorization**: Evaluate whether the user typically engages in SNS subscription actions and if they are authorized to do so for the specified topic.
+- **Contextualize with Related Events**: Review related CloudTrail logs around the event time for other actions by the same user or IP address. Look for activities involving other AWS services, such as S3 or IAM, that may indicate further suspicious behavior.
+- **Check for Publish Actions**: Investigate for any subsequent `Publish` actions on the same SNS topic that may indicate exfiltration attempts or data leakage. If Publish actions are detected, further investigate the contents of the messages.
+- **Review IAM Policies**: Examine the user or role's IAM policies to ensure that the subscription action is within the scope of their permissions or should be.
+
+
+*False Positive Analysis*
+
+
+- **Historical User Actions**: Verify if the user has a history of performing similar actions on SNS topics. Consistent, repetitive actions may suggest legitimate usage.
+- **Scheduled or Automated Tasks**: Confirm if the subscription action aligns with scheduled tasks or automated notifications authorized by your organization.
+
+
+*Response and Remediation*
+
+
+- **Immediate Review and Reversal**: If the subscription was unauthorized, take appropriate action to cancel it and adjust SNS permissions as necessary.
+- **Strengthen Monitoring and Alerts**: Configure monitoring systems to flag similar actions involving sensitive topics or unapproved endpoints.
+- **Policy Review**: Review and update policies related to SNS subscriptions and access, tightening control as needed to prevent unauthorized subscriptions.
+- **Incident Response**: If there is evidence of malicious intent, treat the event as a potential data exfiltration incident and follow incident response protocols, including further investigation, containment, and recovery.
+
+
+*Additional Information*
+
+
+For further guidance on managing and securing SNS topics in AWS environments, refer to the https://docs.aws.amazon.com/sns/latest/dg/welcome.html[AWS SNS documentation] and AWS best practices for security.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "sns.amazonaws.com"
+    and event.action: "Subscribe"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Cloud Storage
+** ID: T1530
+** Reference URL: https://attack.mitre.org/techniques/T1530/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user.asciidoc
new file mode 100644
index 0000000000..0b64ab9af3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user.asciidoc
@@ -0,0 +1,165 @@
+[[prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user]]
+=== AWS SNS Topic Created by Rare User
+
+Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SNS
+* Resources: Investigation Guide
+* Use Case: Threat Detection
+* Tactic: Resource Development
+* Tactic: Impact
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS SNS Topic Created by Rare User*
+
+
+This rule detects the creation of an AWS Simple Notification Service (SNS) topic by a user who does not typically perform this action. Adversaries may create SNS topics to facilitate data exfiltration or other malicious activities.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time by a user or role.
+
+
+*Possible Investigation Steps*
+
+
+
+*Identify the Actor and Context*
+
+- **User Identity and Role**:
+  - Examine `aws.cloudtrail.user_identity.arn` to determine **who** created the SNS topic.
+  - Identify whether the actor assumed a **privileged IAM role** (`aws.cloudtrail.user_identity.type: "AssumedRole"`) or used a long term access keys (`aws.cloudtrail.user_identity.access_key_id`).
+- **User Agent and Tooling**:
+  - Check `user_agent.original` to determine if this action was performed via the AWS CLI, SDK, or Console.
+  - If `aws-cli` was used, review whether it aligns with typical automation or administrative behavior.
+- **Source IP and Geographic Location**:
+  - Review `source.ip` and `source.geo` fields to confirm if the request originated from a **trusted** or **unexpected** location.
+
+
+*Evaluate the SNS Topic Creation*
+
+- **Topic Name and Purpose**:
+  - Check `aws.cloudtrail.request_parameters` for the **SNS topic name** and determine whether it appears suspicious (e.g., random strings, unusual keywords).
+- **Target Region and Account**:
+  - Verify `cloud.region` and `cloud.account.id` to **ensure the SNS topic was created in an expected environment**.
+- **Associated API Calls**:
+  - Identify additional actions **before or after** this event using `event.action` values like:
+    - `Subscribe`
+    - `Publish`
+    - `SetTopicAttributes`
+  - These may indicate follow-up steps taken to misuse the SNS topic.
+
+
+*Analyze Potential Malicious Intent*
+
+- **Is This an Isolated Action or a Pattern?**
+  - Check if this **user has previously created SNS topics** using historical CloudTrail logs.
+  - Look for **multiple topic creations in a short period**, which may suggest an automation script or malicious behavior.
+- **Unusual Role Usage**:
+  - If `aws.cloudtrail.user_identity.arn` references an **EC2 instance role**, verify whether that instance typically performs SNS operations.
+- **Potential Data Exfiltration or Persistence**:
+  - Review whether **new subscriptions** were added (`Subscribe` API action) to forward data externally.
+  - If an SNS topic was configured to trigger **Lambda functions or S3 events**, it may indicate an attempt to persist in the environment.
+
+
+*False Positive Analysis*
+
+- **Legitimate Usage of SNS**:
+  - SNS is commonly used for **event-driven notifications** in AWS.
+  - Check whether the SNS topic creation aligns with known **DevOps, automation, or monitoring activities**.
+- **Routine IAM Role Activity**:
+  - If the user typically interacts with SNS, consider **allowlisting** expected IAM roles for this action.
+- **AWS Services Creating Topics Automatically**:
+  - Some AWS services may **auto-create SNS topics** for alerts and monitoring. Confirm whether the creation was system-generated.
+
+
+*Response and Remediation*
+
+- **Confirm Authorization**:
+  - If the user was not expected to create SNS topics, verify whether their IAM permissions should be restricted.
+- **Revoke Unauthorized Access**:
+  - If unauthorized, disable the access keys or IAM role associated with the event.
+- **Monitor for Further SNS Modifications**:
+  - Set up additional monitoring for **SNS Publish or Subscription events** (`Publish`, `Subscribe`).
+- **Enhance IAM Policy Controls**:
+  - Consider enforcing **least privilege** IAM policies and enabling **multi-factor authentication (MFA)** where applicable.
+- **Investigate for Persistence**:
+  - Check whether the SNS topic is **being used as a notification channel for Lambda, S3, or other AWS services**.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "sns.amazonaws.com"
+    and event.action: "CreateTopic"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Resource Development
+** ID: TA0042
+** Reference URL: https://attack.mitre.org/tactics/TA0042/
+* Technique:
+** Name: Stage Capabilities
+** ID: T1608
+** Reference URL: https://attack.mitre.org/techniques/T1608/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user.asciidoc
new file mode 100644
index 0000000000..01e007ce86
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user.asciidoc
@@ -0,0 +1,177 @@
+[[prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user]]
+=== AWS SNS Topic Message Publish by Rare User
+
+Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/sns/latest/api/API_Publish.html
+* https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SNS
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Lateral Movement
+* Tactic: Exfiltration
+* Tactic: Impact
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS SNS Topic Message Publish by Rare User*
+
+
+This rule identifies when a message is published to an SNS topic by a user who has rarely or never published messages before. This activity could indicate adversarial actions, such as using SNS topics for phishing campaigns, data exfiltration, or lateral movement within an AWS environment.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time by a user or role.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Actor and Resource**:
+  - **User Identity and Role**: Examine the `aws.cloudtrail.user_identity.arn` to identify the user or role responsible for publishing the SNS message. Verify whether this actor is authorized to publish messages to SNS topics.
+  - **Access Key Details**: Review the `aws.cloudtrail.user_identity.access_key_id` to determine the access key used.
+  - **SNS Topic ARN**: Analyze `aws.cloudtrail.resources.arn` to confirm whether the SNS topic is critical, sensitive, or used for authorized purposes.
+
+- **Evaluate the Context of the SNS Message**:
+  - **Published Message Details**: AWS redacts the message content in CloudTrail logs, but you can view the message ID, subject, and other metadata. Investigate the message details for any indicators of malicious content.
+  - **Message Recipients**: Investigate the subscriptions associated with the SNS topic to identify if messages were sent to unauthorized or unexpected recipients.
+
+- **Analyze Source Information**:
+  - **Source IP Address**: Examine the `source.ip` field to identify the origin of the activity. Unusual IP addresses or geolocations may indicate unauthorized access.
+  - **User Agent**: Review `user_agent.original` to determine the tool or client used for publishing the SNS message. Automated tools or unexpected clients (e.g., `Boto3` from an unknown host) may signify misuse.
+
+- **Review Historical Activity**:
+  - **Actor’s Past Behavior**: Identify whether the user has published messages to SNS topics before. Review similar past events for context.
+  - **Frequency and Patterns**: Examine the time and frequency of messages published by the same user or to the same SNS topic to detect anomalies.
+
+- **Correlate with Other Events**:
+  - **IAM or CloudTrail Events**: Look for events such as `AssumeRole`, `CreateAccessKey`, or other API actions associated with the same user ARN.
+  - **Unusual IAM Role Activity**: Determine if the actor has assumed roles or performed administrative tasks atypical for their role.
+
+
+*False Positive Analysis*
+
+
+- **Routine Operational Use**:
+  - Confirm if the publishing activity aligns with standard operational tasks or automation scripts.
+  - Validate whether new or rare users were recently granted permissions for publishing messages to SNS topics.
+
+- **Testing or Monitoring Scripts**:
+  - Automated testing or monitoring tools may trigger this rule if configured to publish messages to SNS topics.
+
+
+*Response and Remediation*
+
+
+- **Immediate Action**:
+  - If unauthorized activity is confirmed, disable the access key or IAM role associated with the user.
+  - Restrict or remove permissions from the SNS topic to prevent further misuse.
+
+- **Review Policies and Subscriptions**:
+  - Audit the IAM policies tied to the user and SNS topic to ensure appropriate permissions.
+  - Validate the subscriptions of the SNS topic to confirm all endpoints are authorized.
+
+- **Enhance Monitoring and Alerting**:
+  - Set up additional logging or alerting for SNS publish actions, especially from rare or unknown users.
+  - Monitor for similar actions across other SNS topics within the environment.
+
+- **Conduct a Root Cause Analysis**:
+  - Investigate how the user or role gained access to publish messages to the SNS topic.
+  - Determine if other AWS resources or services have been affected.
+
+
+*Additional Information*
+
+
+For more information on SNS topic management and securing AWS resources, refer to:
+- https://docs.aws.amazon.com/sns/latest/api/API_Publish.html[AWS SNS Publish API Documentation]
+- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html[AWS CloudTrail Documentation]
+
+
+==== Setup
+
+
+AWS SNS topic data event types need to be enabled in the CloudTrail trail configuration to capture the Publish action. Ensure that the AWS CloudTrail service is https://docs.aws.amazon.com/sns/latest/dg/logging-using-cloudtrail.html#cloudtrail-data-events[configured] to log data events for SNS.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:"aws.cloudtrail"
+    and event.provider:"sns.amazonaws.com"
+    and event.action:"Publish"
+    and event.outcome:"success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Internal Spearphishing
+** ID: T1534
+** Reference URL: https://attack.mitre.org/techniques/T1534/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance.asciidoc
new file mode 100644
index 0000000000..3ba4681e3f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance.asciidoc
@@ -0,0 +1,125 @@
+[[prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance]]
+=== AWS SSM Session Started to EC2 Instance
+
+Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html
+* https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/
+* https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc
+* https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SSM
+* Data Source: AWS EC2
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS SSM Session Started to EC2 Instance*
+
+
+This rule detects the first instance of an AWS user or role initiating an SSM session to an EC2 instance, which could be indicative of legitimate administrative activities or potential malicious actions like command execution or lateral movement.
+
+
+*Possible Investigation Steps*
+
+
+- **Examine the Session Start Event**: Review the AWS CloudTrail log for the event.
+    - Determine the target EC2 instance using `aws.cloudtrail.request_parameters`.
+- **Verify User Identity and Role**: Check the user’s ARN and access key ID (`aws.cloudtrail.user_identity.access_key_id`).
+    - Determine if their role typically requires initiating SSM sessions.
+- **Assess Geographic and IP Context**: Analyze the source IP (`source.ip`) and geographic location (`source.geo`) from which the session was initiated.
+    - Determine if these are consistent with typical user locations or if they raise suspicions of compromise or misuse.
+- **Review Session Details**: Examine details like the session ID and stream URL (`aws.cloudtrail.response_elements`) to understand the scope and nature of the session.
+    - Check if any commands executed during the session were unauthorized or out of ordinary practices.
+- **Correlate with Other Security Events**: Look for other related security events around the time of the session start to identify any pattern or broader attack vector that may involve this user or EC2 instance.
+
+
+*False Positive Analysis*
+
+
+- **Legitimate Administrative Activities**: Confirm whether the SSM session was initiated for valid administrative purposes such as system maintenance, patching, or configuration updates. Verify with the respective teams or personnel.
+
+
+*Response and Remediation*
+
+
+- **Incident Response Activation**: If malicious intent or actions are confirmed, activate the incident response protocol.
+    - This includes containment of the threat, eradication of the adversary’s presence, recovery of affected systems, and a thorough investigation.
+- **Validate and Reinforce Security Policies**: Ensure that policies around SSM session initiation are strict and adhere to the principle of least privilege.
+    - Update IAM policies if necessary to tighten controls.
+- **Enhance Monitoring and Alerts**: Improve monitoring of SSM sessions, particularly focusing on sessions that involve sensitive or critical EC2 instances.
+    - Adjust alerting mechanisms to flag unusual session initiations promptly.
+
+
+*Additional Information*
+
+
+For more in-depth understanding of managing SSM sessions and security best practices, refer to the https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html[AWS Systems Manager documentation]. Additionally, consider the security implications and best practices outlined in https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc[AWS SSM privilege escalation techniques].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:"aws.cloudtrail" and event.provider:"ssm.amazonaws.com"
+    and event.action:"StartSession" and event.outcome:"success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Cloud Services
+** ID: T1021.007
+** Reference URL: https://attack.mitre.org/techniques/T1021/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-bypass-uac-via-event-viewer.asciidoc
new file mode 100644
index 0000000000..cd4b42fabb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-bypass-uac-via-event-viewer.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-18-14-bypass-uac-via-event-viewer]]
+=== Bypass UAC via Event Viewer
+
+Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Windows Security Event Logs
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 321
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Bypass UAC via Event Viewer*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "eventvwr.exe" and
+  not process.executable : (
+        "?:\\Windows\\SysWOW64\\mmc.exe",
+        "?:\\Windows\\System32\\mmc.exe",
+        "?:\\Windows\\SysWOW64\\WerFault.exe",
+        "?:\\Windows\\System32\\WerFault.exe",
+
+        /* Crowdstrike specific exclusion as it uses NT Object paths */
+        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\mmc.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\WerFault.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-console-history.asciidoc
new file mode 100644
index 0000000000..be68b989c1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-console-history.asciidoc
@@ -0,0 +1,149 @@
+[[prebuilt-rule-8-18-14-clearing-windows-console-history]]
+=== Clearing Windows Console History
+
+Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/
+* https://www.shellhacks.com/clear-history-powershell/
+* https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Console History*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+  - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
+  ) and
+  (
+    process.args : "*Clear-History*" or
+    (process.args : ("*Remove-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")) or
+    (process.args : "*Set-PSReadlineOption*" and process.args : "*SaveNothing*")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Command History
+** ID: T1070.003
+** Reference URL: https://attack.mitre.org/techniques/T1070/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-event-logs.asciidoc
new file mode 100644
index 0000000000..9b7f92e234
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-clearing-windows-event-logs.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-18-14-clearing-windows-event-logs]]
+=== Clearing Windows Event Logs
+
+Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 319
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Event Logs*
+
+
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+
+This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.
+- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (process.name : "wevtutil.exe" or ?process.pe.original_file_name == "wevtutil.exe") and
+    process.args : ("/e:false", "cl", "clear-log")
+  ) or
+  (
+    (
+      process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
+    ) and
+    process.args : "Clear-EventLog"
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts.asciidoc
new file mode 100644
index 0000000000..776407dbdb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts]]
+=== Command and Scripting Interpreter via Windows Scripts
+
+Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+* endgame-*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Windows Security Event Logs
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Elastic Endgame
+* Data Source: Crowdstrike
+
+*Version*: 207
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Command and Scripting Interpreter via Windows Scripts*
+
+
+PowerShell, a powerful scripting language in Windows, is often targeted by adversaries for executing malicious scripts. Attackers exploit Windows Script Host processes like cscript or wscript to launch PowerShell with obfuscated commands, evading detection. The detection rule identifies such suspicious activity by monitoring PowerShell executions with specific patterns and parent processes, while filtering out known legitimate use cases to reduce false positives.
+
+
+*Possible investigation steps*
+
+
+- Review the process command line and arguments to identify any obfuscation patterns or suspicious commands, such as Base64 encoding or web requests, that match the query's suspicious patterns.
+- Examine the parent process details, specifically focusing on wscript.exe, cscript.exe, or mshta.exe, to determine if the PowerShell execution was initiated by a legitimate script or a potentially malicious one.
+- Check the process execution context, including the user account and host, to assess if the activity aligns with expected behavior for that user or system.
+- Investigate any network connections or file downloads initiated by the PowerShell process, especially those involving external IP addresses or domains, to identify potential data exfiltration or further malicious activity.
+- Correlate the alert with other security events or logs from the same host or user to identify any preceding or subsequent suspicious activities that could indicate a broader attack campaign.
+
+
+*False positive analysis*
+
+
+- Legitimate PowerShell commands using non-shortened execution flags may trigger false positives. To manage this, exclude processes with arguments like "-EncodedCommand", "Import-Module*", and "-NonInteractive" unless they are associated with suspicious activity.
+- Third-party installation scripts, such as those related to Microsoft System Center or WebLogic, can cause false positives. Exclude these by filtering out specific parent process arguments or command lines, such as "Microsoft.SystemCenter.ICMPProbe.WithConsecutiveSamples.vbs" and "WEBLOGIC_ARGS_CURRENT_1.DATA".
+- Routine administrative tasks, like gathering network information, may be flagged. Exclude known scripts like "gatherNetworkInfo.vbs" from detection to prevent unnecessary alerts.
+- Exclude specific user scripts or tools that are known to be safe, such as those located in user directories like "C:\Users\Prestige\AppData\Local\Temp\Rar$*\KMS_VL_ALL_AIO.cmd" if they are verified as non-malicious.
+- Regularly review and update exclusion lists to ensure they reflect current legitimate activities and do not inadvertently allow new threats.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further malicious activity and lateral movement.
+- Terminate any suspicious PowerShell processes identified by the alert to stop ongoing malicious execution.
+- Conduct a thorough review of the affected system's PowerShell execution logs to identify any additional malicious scripts or commands that may have been executed.
+- Remove any malicious scripts or files identified during the investigation from the system to prevent re-execution.
+- Restore the system from a known good backup if any critical system files or configurations have been altered by the malicious activity.
+- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
+- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.command_line != null and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe", "cmd.exe") or
+    ?process.pe.original_file_name : ("powershell.exe", "pwsh.dll", "powershell_ise.exe", "Cmd.Exe")
+  ) and
+  process.parent.name : ("wscript.exe", "mshta.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-component-object-model-hijacking.asciidoc
new file mode 100644
index 0000000000..b5298d9342
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-component-object-model-hijacking.asciidoc
@@ -0,0 +1,211 @@
+[[prebuilt-rule-8-18-14-component-object-model-hijacking]]
+=== Component Object Model Hijacking
+
+Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 117
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Component Object Model Hijacking*
+
+
+Adversaries can insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means of persistence.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Retrieve the file referenced in the registry and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- Some Microsoft executables will reference the LocalServer32 registry key value for the location of external COM objects.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  /* not necessary but good for filtering privileged installations */
+  user.domain != "NT AUTHORITY" and process.executable != null and 
+  (
+    (
+      registry.path : "HK*\\InprocServer32\\" and
+      registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
+      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
+    ) or
+
+    (
+      registry.path : "HKLM\\*\\InProcServer32\\*" and
+        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
+    ) or
+
+    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
+    (
+      registry.path : (
+        "HKEY_USERS\\*\\InprocServer32\\",
+        "HKEY_USERS\\*\\LocalServer32\\",
+        "HKEY_USERS\\*\\DelegateExecute",
+        "HKEY_USERS\\*\\TreatAs\\",
+        "HKEY_USERS\\*\\ScriptletURL*"
+      ) and
+      not registry.data.strings : (
+            /* COM related to Windows Spotlight feature */
+            "{4813071a-41ad-44a2-9835-886d2f63ca30}",
+
+            /* AppX/MSIX DelegateExecute handlers: execute, protocol, file */
+            "{A56A841F-E974-45C1-8001-7E3F8A085917}",
+            "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
+            "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
+      )
+    )
+  ) and 
+  
+  not (
+    process.code_signature.trusted == true and
+    process.code_signature.subject_name in (
+        "Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.", "Adobe Inc.",
+        "Citrix Systems, Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.", "Oracle America, Inc.",
+        "Brave Software, Inc.", "DeepL SE", "Opera Norway AS"
+    )
+  ) and 
+
+  /* excludes Microsoft signed noisy processes */
+  not
+  (
+    process.name : (
+      "OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe",
+      "MicrosoftEdgeUpdateComRegisterShell64.exe", "setup.exe"
+    ) and
+    process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
+  ) and
+  
+  not process.executable : (
+        "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Program Files\\*.exe",
+        "?:\\ProgramData\\4Team\\4Team-Updater\\4Team-Updater-Helper.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+        "?:\\Users\\*\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe",
+        "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
+        "?:\\Windows\\System32\\msiexec.exe",
+        "?:\\Windows\\System32\\svchost.exe",
+        "?:\\Windows\\SysWOW64\\regsvr32.exe",
+        "?:\\Windows\\System32\\regsvr32.exe",
+        "\\Device\\Mup\\*\\Kufer\\KuferSQL\\BasysSQL.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Component Object Model Hijacking
+** ID: T1546.015
+** Reference URL: https://attack.mitre.org/techniques/T1546/015/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Component Object Model Hijacking
+** ID: T1546.015
+** Reference URL: https://attack.mitre.org/techniques/T1546/015/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints.asciidoc
new file mode 100644
index 0000000000..fee5e7cd72
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints.asciidoc
@@ -0,0 +1,179 @@
+[[prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints]]
+=== Connection to Common Large Language Model Endpoints
+
+Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.network-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://malpedia.caad.fkie.fraunhofer.de/details/py.lamehug
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Sysmon
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Connection to Common Large Language Model Endpoints*
+
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes or malicious scripts.
+- Verify if the executed process is persistent on the host like common mechanisms Startup folder, task or Run key.
+- Review any unusual network, files or registry events by the same process.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
+
+
+*False positive analysis*
+
+
+- Trusted applications from an expected process running in the environment.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Immediately block the identified indicators of compromise (IoCs).
+- Implement any temporary network rules, procedures, and segmentation required to contain the attack.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Update firewall rules to be more restrictive.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and dns.question.name != null and
+(
+  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
+  "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "python.exe", "regsvr32.exe", "dllhost.exe",
+  "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com") or
+
+  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
+
+  (
+    process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe") and
+    (?process.code_signature.trusted == false or ?process.code_signature.exists == false)
+  )
+ ) and
+    dns.question.name : (
+    // Major LLM APIs
+    "api.openai.com",
+    "*.openai.azure.com",
+    "api.anthropic.com",
+    "api.mistral.ai",
+    "api.cohere.ai",
+    "api.ai21.com",
+    "api.groq.com",
+    "api.perplexity.ai",
+    "api.x.ai",
+    "api.deepseek.com",
+    "api.gemini.google.com",
+    "generativelanguage.googleapis.com",
+    "api.azure.com",
+    "api.bedrock.aws",
+    "bedrock-runtime.amazonaws.com",
+
+    // Hugging Face & other ML infra
+    "api-inference.huggingface.co",
+    "inference-endpoint.huggingface.cloud",
+    "*.hf.space",
+    "*.replicate.com",
+    "api.replicate.com",
+    "api.runpod.ai",
+    "*.runpod.io",
+    "api.modal.com",
+    "*.forefront.ai",
+
+    // Consumer-facing AI chat portals
+    "chat.openai.com",
+    "chatgpt.com",
+    "copilot.microsoft.com",
+    "bard.google.com",
+    "gemini.google.com",
+    "claude.ai",
+    "perplexity.ai",
+    "poe.com",
+    "chat.forefront.ai",
+    "chat.deepseek.com"
+  ) and
+
+  not process.executable : (
+          "?:\\Program Files\\*.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\Windows\\System32\\svchost.exe",
+          "?:\\Windows\\SystemApps\\Microsoft.LockApp_*\\LockApp.exe",
+          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
+          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe"
+        ) and
+    not (?process.code_signature.trusted == true and
+         ?process.code_signature.subject_name : ("Anthropic, PBC", "Google LLC", "Mozilla Corporation", "Brave Software, Inc.", "Island Technology Inc.", "Opera Norway AS"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Web Service
+** ID: T1102
+** Reference URL: https://attack.mitre.org/techniques/T1102/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services.asciidoc
new file mode 100644
index 0000000000..0b96078d46
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services.asciidoc
@@ -0,0 +1,333 @@
+[[prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services]]
+=== Connection to Commonly Abused Web Services
+
+Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/operation-bleeding-bear
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+
+*Version*: 122
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Connection to Commonly Abused Web Services*
+
+
+Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
+
+This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Verify whether the digital signature exists in the executable.
+- Identify the operation type (upload, download, tunneling, etc.).
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"},{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and
+    dns.question.name != null and process.name != null and
+    not (?user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") or user.domain == "NT AUTHORITY") and
+    /* Add new WebSvc domains here */
+    dns.question.name :
+       (
+        "raw.githubusercontent.*",
+        "pastebin.*",
+        "paste4btc.com",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "?.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "*.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "apis.azureedge.net",
+        "cdn.sql.gg",
+        "?.top4top.io",
+        "top4top.io",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "gofile.io",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "t.me",
+        "meacz.gq",
+        "rwrd.org",
+        "*.publicvm.com",
+        "*.blogspot.com",
+        "api.mylnikov.org",
+        "file.io",
+        "stackoverflow.com",
+        "*files.1drv.com",
+        "api.anonfile.com",
+        "*hosting-profi.de",
+        "ipbase.com",
+        "ipfs.io",
+        "*up.freeo*.space",
+        "api.mylnikov.org",
+        "script.google.com",
+        "script.googleusercontent.com",
+        "api.notion.com",
+        "graph.microsoft.com",
+        "*.sharepoint.com",
+        "mbasic.facebook.com",
+        "login.live.com",
+        "api.gofile.io",
+        "api.anonfiles.com",
+        "api.notion.com",
+        "api.trello.com",
+        "gist.githubusercontent.com",
+        "files.pythonhosted.org",
+        "g.live.com",
+        "*.zulipchat.com",
+        "webhook.site",
+        "run.mocky.io",
+        "mockbin.org", 
+        "www.googleapis.com", 
+        "googleapis.com",
+        "global.rel.tunnels.api.visualstudio.com",
+        "*.devtunnels.ms", 
+        "api.github.com") and
+        
+    /* Insert noisy false positives here */
+    not (
+      (
+        process.executable : (
+          "?:\\Program Files\\*.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
+          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
+          "?:\\Users\\*\\AppData\\Local\\PowerToys\\PowerToys.exe",
+          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Zen Browser\\zen.exe",
+          "?:\\Users\\*\\Wavesor Software\\WaveBrowser\\wavebrowser.exe",
+          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+          "?:\\Windows\\system32\\mobsync.exe",
+          "?:\\Windows\\SysWOW64\\mobsync.exe", 
+          "?:\\Windows\\system32\\svchost.exe",
+          "?:\\Windows\\System32\\smartscreen.exe",
+          "?:\\Windows\\System32\\wsl.exe", 
+          "?:\\Windows\\System32\\WWAHost.exe"
+        )
+      ) or
+    
+      /* Discord App */
+      (process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
+      ) or 
+
+      /* MS Sharepoint / OneDrive */
+      (process.name : ("Microsoft.SharePoint.exe", "OneDrive.Sync.Service.exe") and dns.question.name : "onedrive.live.com" and
+       (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+      ) or 
+
+      /* Obsidian - Plugins are stored on raw.githubusercontent.com */
+      (process.name : "Obsidian.exe" and (process.code_signature.subject_name : "Dynalist Inc" and
+       process.code_signature.trusted == true) and dns.question.name : "raw.githubusercontent.com"
+      ) or 
+
+      /* WebExperienceHostApp */
+      (process.name : "WebExperienceHostApp.exe" and (process.code_signature.subject_name : "Microsoft Windows" and
+       process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com")
+      ) or
+
+      /* IntelliJ IDEA connecting to raw.githubusercontent.com */
+      (process.code_signature.subject_name : "JetBrains s.r.o." and
+       process.code_signature.trusted == true and dns.question.name : ("api.github.com", "raw.githubusercontent.com")
+      ) or 
+
+      (process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true and
+       dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com")
+      ) or
+
+      (process.code_signature.subject_name : "Python Software Foundation" and process.code_signature.trusted == true and
+       dns.question.name : "files.pythonhosted.org") or 
+
+      /* Zoom */
+      (process.name : "Zoom.exe" and (process.code_signature.subject_name : "Zoom Video Communications, Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("www.googleapis.com", "graph.microsoft.com")
+      ) or
+
+      /* VSCode */
+      (process.name : "Code.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
+       process.code_signature.trusted == true) and dns.question.name : ("api.github.com", "raw.githubusercontent.com")
+      ) or
+
+      /* Terraform */
+      (process.name : "terraform-provider*.exe" and (process.code_signature.subject_name : "HashiCorp, Inc." and
+       process.code_signature.trusted == true) and dns.question.name : "graph.microsoft.com"
+      ) or
+
+      (
+        process.code_signature.trusted == true and
+        process.code_signature.subject_name : (
+                              "Johannes Schindelin",
+                              "Redis Inc.",
+                              "Slack Technologies, LLC",
+                              "Cisco Systems, Inc.",
+                              "Dropbox, Inc",
+                              "Amazon.com Services LLC", 
+                              "Island Technology Inc.", 
+                              "GitHub, Inc.", 
+                              "Red Hat, Inc",
+                              "Mozilla Corporation"
+        )
+      )
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Web Service
+** ID: T1102
+** Reference URL: https://attack.mitre.org/techniques/T1102/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Sub-technique:
+** Name: Exfiltration to Code Repository
+** ID: T1567.001
+** Reference URL: https://attack.mitre.org/techniques/T1567/001/
+* Sub-technique:
+** Name: Exfiltration to Cloud Storage
+** ID: T1567.002
+** Reference URL: https://attack.mitre.org/techniques/T1567/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-crowdstrike-external-alerts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-crowdstrike-external-alerts.asciidoc
new file mode 100644
index 0000000000..17ed5b911f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-crowdstrike-external-alerts.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-18-14-crowdstrike-external-alerts]]
+=== CrowdStrike External Alerts
+
+Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-crowdstrike.alert-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 1m
+
+*Searches indices from*: now-2m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 1000
+
+*References*: 
+
+* https://docs.elastic.co/en/integrations/crowdstrike
+
+*Tags*: 
+
+* Data Source: Crowdstrike
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Promotion: External Alerts
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating CrowdStrike External Alerts*
+
+
+CrowdStrike Falcon is a cloud-native endpoint protection platform that delivers real-time threat detection and response capabilities. The rule captures security alerts generated by Falcon and enables analysts to investigate threats rapidly based on behavioral indicators and threat intelligence.
+
+
+*Possible investigation steps*
+
+
+- Review the associated process, file path, and command line to determine whether the activity is legitimate or suspicious.
+- Investigate the user account and host involved in the alert to validate whether the activity was authorized.
+- Cross-reference the alert with CrowdStrike Falcon console for additional context, including process tree, behavioral tags, and threat intelligence matches.
+- Check for any related alerts from the same host, user, or file hash to identify whether this is part of a larger attack chain.
+- Consult the Crowdstrike investigation guide and resources tagged in the alert for specific guidance on handling similar threats.
+
+
+*False positive analysis*
+
+
+- Alerts involving known and trusted software tools (e.g., remote administration tools) may be false positives. Confirm intent before excluding.
+- Security assessments or penetration testing activities might mimic real threats. Validate the activity with responsible teams.
+- Scheduled jobs, IT scripts, or automation tools may trigger alerts if they behave similarly to malicious code.
+- Review alerts based on detection confidence levels and behavioral scoring to filter out low-confidence or known-benign triggers.
+
+
+*Response and remediation*
+
+
+- Isolate affected endpoints to prevent lateral movement if malicious behavior is confirmed.
+- Quarantine any identified malicious files and block related hashes or domains.
+- Investigate how the threat entered the environment and close any exploited vulnerabilities.
+- Reset credentials for compromised user accounts or escalate to incident response.
+- Review CrowdStrike Falcon policies and detections to fine-tune future alerting and response coverage.
+- Document the findings and update detection logic or exceptions accordingly.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+
+*CrowdStrike Alert Integration*
+
+This rule is designed to capture alert events generated by the CrowdStrike integration and promote them as Elastic detection alerts.
+
+To capture CrowdStrike alerts, install and configure the CrowdStrike integration to ingest alert events into the `logs-crowdstrike.alert-*` index pattern.
+
+If this rule is enabled alongside the External Alerts promotion rule (UUID: eb079c62-4481-4d6e-9643-3ca499df7aaa), you may receive duplicate alerts for the same CrowdStrike events. Consider adding a rule exception for the External Alert rule to exclude data_stream.dataset:crowdstrike.alert to avoid receiving duplicate alerts.
+
+
+*Additional notes*
+
+
+For information on troubleshooting the maximum alerts warning please refer to this https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts[guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.kind: alert and data_stream.dataset: crowdstrike.alert
+
+----------------------------------
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-d-bus-service-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-d-bus-service-created.asciidoc
new file mode 100644
index 0000000000..a2937909c2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-d-bus-service-created.asciidoc
@@ -0,0 +1,190 @@
+[[prebuilt-rule-8-18-14-d-bus-service-created]]
+=== D-Bus Service Created
+
+This rule detects the creation of D-Bus service files on Linux systems. D-Bus is a message bus system that provides a way for applications to talk to one another. D-Bus services are defined in service files that are typically located in default directories. The rule looks for the creation of service files that are not associated with known package managers or system services. Attackers may create malicious D-Bus services to establish persistence or escalate privileges on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file*
+* logs-sentinel_one_cloud_funnel.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating D-Bus Service Created*
+
+
+D-Bus is an inter-process communication system in Linux, enabling applications to communicate. Adversaries may exploit D-Bus by creating unauthorized service files to maintain persistence or escalate privileges. The detection rule identifies suspicious service file creations in key directories, excluding known legitimate processes, to flag potential malicious activity.
+
+
+*Possible investigation steps*
+
+
+- Review the file path and extension to confirm if the created file is located in one of the monitored directories such as /usr/share/dbus-1/system-services/ or /etc/dbus-1/system.d/, and ensure it has a .service or .conf extension.
+- Examine the process executable that created the file to determine if it is listed as a known legitimate process in the exclusion list. If not, investigate the process further to understand its origin and purpose.
+- Check the process name and path for any unusual or unexpected patterns, especially if it is not part of the known exclusions like ssm-agent-worker or platform-python*.
+- Investigate the file creation time and correlate it with other system activities or logs to identify any suspicious behavior or patterns around the time of the alert.
+- Look into the user account associated with the process that created the file to determine if it has the necessary permissions and if the activity aligns with the user's typical behavior.
+- Search for any related alerts or logs that might indicate a broader attack pattern, such as other unauthorized file creations or modifications in the system.
+
+
+*False positive analysis*
+
+
+- Package manager operations can trigger false positives when legitimate service files are created during software installations or updates. To manage this, exclude processes associated with known package managers like dpkg, rpm, and yum from the detection rule.
+- System service updates may also result in false positives. Exclude processes such as systemd and crond that are responsible for legitimate system service management.
+- Development and testing environments often involve the creation of temporary or test service files. Exclude paths and processes specific to these environments, such as those under /tmp or /dev/fd, to reduce noise.
+- Automation tools like Puppet and Chef can create service files as part of their configuration management tasks. Exclude these tools by adding their executable paths to the exception list.
+- Custom scripts or tools that mimic package manager behavior might also cause false positives. Identify and exclude these specific scripts or tools by their process names or paths if they are known to be benign.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Terminate any suspicious processes associated with the creation of unauthorized D-Bus service files to halt potential malicious activity.
+- Remove any unauthorized D-Bus service files identified in the specified directories to eliminate persistence mechanisms.
+- Conduct a thorough review of user accounts and privileges on the affected system to ensure no unauthorized privilege escalation has occurred.
+- Restore the system from a known good backup if unauthorized changes or damage to the system are detected.
+- Monitor the system and network for any signs of re-infection or similar suspicious activities, using enhanced logging and alerting mechanisms.
+- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and process.executable != null and
+file.extension in ("service", "conf") and file.path like~ (
+  "/usr/share/dbus-1/system-services/*", "/etc/dbus-1/system.d/*",
+  "/lib/dbus-1/system-services/*", "/run/dbus/system.d/*",
+  "/home/*/.local/share/dbus-1/services/*", "/home/*/.dbus/session-bus/*",
+  "/usr/share/dbus-1/services/*", "/etc/dbus-1/session.d/*"
+) and not (
+  process.executable in (
+    "/bin/dpkg", "/usr/bin/dpkg", "/bin/dockerd", "/usr/bin/dockerd", "/usr/sbin/dockerd", "/bin/microdnf",
+    "/usr/bin/microdnf", "/bin/rpm", "/usr/bin/rpm", "/bin/snapd", "/usr/bin/snapd", "/bin/yum", "/usr/bin/yum",
+    "/bin/dnf", "/usr/bin/dnf", "/bin/podman", "/usr/bin/podman", "/bin/dnf-automatic", "/usr/bin/dnf-automatic",
+    "/bin/pacman", "/usr/bin/pacman", "/usr/bin/dpkg-divert", "/bin/dpkg-divert", "/sbin/apk", "/usr/sbin/apk",
+    "/usr/local/sbin/apk", "/usr/bin/apt", "/usr/sbin/pacman", "/bin/podman", "/usr/bin/podman", "/usr/bin/puppet",
+    "/bin/puppet", "/opt/puppetlabs/puppet/bin/puppet", "/usr/bin/chef-client", "/bin/chef-client",
+    "/bin/autossl_check", "/usr/bin/autossl_check", "/proc/self/exe", "/dev/fd/*",  "/usr/bin/pamac-daemon",
+    "/bin/pamac-daemon", "/usr/lib/snapd/snapd", "/usr/local/bin/dockerd", "/usr/bin/crio", "/usr/sbin/crond",
+    "/opt/puppetlabs/puppet/bin/ruby", "/usr/libexec/platform-python", "/kaniko/kaniko-executor",
+    "/usr/local/bin/dockerd", "/usr/bin/podman", "/bin/install", "/proc/self/exe", "/usr/lib/systemd/systemd",
+    "/usr/sbin/sshd", "/usr/bin/gitlab-runner", "/opt/gitlab/embedded/bin/ruby", "/usr/sbin/gdm", "/usr/bin/install",
+    "/usr/local/manageengine/uems_agent/bin/dcregister"
+  ) or
+  process.executable : (
+    "/nix/store/*", "/var/lib/dpkg/*", "/tmp/vmis.*", "/snap/*", "/dev/fd/*", "/usr/lib/virtualbox/*"
+  ) or
+  process.name like (
+    "ssm-agent-worker", "platform-python*", "dnf_install", "cloudflared", "lxc-pve-prestart-hook",
+    "convert-usrmerge", "elastic-agent", "google_metadata_script_runner", "update-alternatives", "gitlab-runner",
+    "install", "crio", "apt-get", "package-cleanup", "dcservice", "dcregister", "jumpcloud-agent", "executor"
+  ) or
+  (process.name == "sed" and file.name : "sed*") or
+  (process.name == "perl" and file.name : "e2scrub_all.tmp*") 
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
new file mode 100644
index 0000000000..e64e45dc3a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
@@ -0,0 +1,152 @@
+[[prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader]]
+=== Deprecated - Execution of File Written or Modified by PDF Reader
+
+Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Deprecated - Execution of File Written or Modified by PDF Reader*
+
+
+PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
+
+This rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as PDF readers.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve the PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=2h
+  [file where host.os.type == "windows" and event.type != "deletion" and file.extension : "exe" and
+     (process.name : "AcroRd32.exe" or
+      process.name : "rdrcef.exe" or
+      process.name : "FoxitPhantomPDF.exe" or
+      process.name : "FoxitReader.exe") and
+     not (file.name : "FoxitPhantomPDF.exe" or
+          file.name : "FoxitPhantomPDFUpdater.exe" or
+          file.name : "FoxitReader.exe" or
+          file.name : "FoxitReaderUpdater.exe" or
+          file.name : "AcroRd32.exe" or
+          file.name : "rdrcef.exe")
+  ] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
new file mode 100644
index 0000000000..5cadcde419
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -0,0 +1,156 @@
+[[prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools]]
+=== Disable Windows Event and Security Logs Using Built-in Tools
+
+Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman
+* https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 318
+
+*Rule authors*: 
+
+* Elastic
+* Ivan Ninichuck
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disable Windows Event and Security Logs Using Built-in Tools*
+
+
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+
+This rule looks for the usage of different utilities to disable the EventLog service or specific event logs.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Re-enable affected logging components, services, and security monitoring.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
+    process.args : "EventLog-*" and process.args : ("stop", "delete")
+  ) or
+  (
+    (
+      process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or
+      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
+    ) and
+	  process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled"
+  )  or
+  (
+    (process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable"
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell.asciidoc
new file mode 100644
index 0000000000..bf199c9eb3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell]]
+=== Disabling Windows Defender Security Settings via PowerShell
+
+Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
+* https://www.elastic.co/security-labs/operation-bleeding-bear
+* https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disabling Windows Defender Security Settings via PowerShell*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
+
+This rule monitors the execution of commands that can tamper the Windows Defender antivirus features.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state, sample submission, etc.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
+
+
+*Related rules*
+
+
+- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
+- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Based on the command line, take actions to restore the appropriate Windows Defender antivirus configurations.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
+  ) and
+  process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z.asciidoc
new file mode 100644
index 0000000000..6973ec5acb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z.asciidoc
@@ -0,0 +1,149 @@
+[[prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z]]
+=== Encrypting Files with WinRar or 7z
+
+Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Encrypting Files with WinRar or 7z*
+
+
+Attackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.
+
+These steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the encrypted file.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if the password used in the encryption was included in the command line.
+- Decrypt the `.rar`/`.zip` and check if the information is sensitive.
+- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the file names included in the encrypted file.
+- Investigate if the file was transferred to an attacker-controlled server.
+
+
+*False positive analysis*
+
+
+- Backup software can use these utilities. Check the `process.parent.executable` and `process.parent.command_line` fields to determine what triggered the encryption.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (
+      process.name : ("rar.exe", "WinRAR.exe") or ?process.code_signature.subject_name == "win.rar GmbH" or
+      ?process.pe.original_file_name == "WinRAR.exe"
+    ) and
+    process.args == "a" and process.args : ("-hp*", "-p*", "/hp*", "/p*")
+  ) or
+  (
+    (process.name : ("7z.exe", "7za.exe") or ?process.pe.original_file_name in ("7z.exe", "7za.exe")) and
+    process.args == "a" and process.args : "-p*"
+  )
+) and
+  not process.parent.executable : (
+        "C:\\Program Files\\*.exe",
+        "C:\\Program Files (x86)\\*.exe",
+        "?:\\ManageEngine\\*\\jre\\bin\\java.exe",
+        "?:\\Nox\\bin\\Nox.exe",
+        "\\Device\\HarddiskVolume?\\Program Files\\*.exe",
+        "\\Device\\HarddiskVolume?\\Program Files (x86)\\*.exe",
+        "\\Device\\HarddiskVolume?\\ManageEngine\\*\\jre\\bin\\java.exe",
+        "\\Device\\HarddiskVolume?\\Nox\\bin\\Nox.exe"
+      )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Local System
+** ID: T1005
+** Reference URL: https://attack.mitre.org/techniques/T1005/
+* Technique:
+** Name: Archive Collected Data
+** ID: T1560
+** Reference URL: https://attack.mitre.org/techniques/T1560/
+* Sub-technique:
+** Name: Archive via Utility
+** ID: T1560.001
+** Reference URL: https://attack.mitre.org/techniques/T1560/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user.asciidoc
new file mode 100644
index 0000000000..dff389b851
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user]]
+=== Entra ID MFA Disabled for User
+
+Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-azure.auditlogs-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: Identity
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Persistence
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Entra ID MFA Disabled for User*
+
+
+Multi-factor authentication is a process in which users are prompted during the sign-in process for an additional form of identification, such as a code on their cellphone or a fingerprint scan.
+
+If you only use a password to authenticate a user, it leaves an insecure vector for attack. If the password is weak or has been exposed elsewhere, an attacker could be using it to gain access. When you require a second form of authentication, security is increased because this additional factor isn't something that's easy for an attacker to obtain or duplicate.
+
+For more information about using MFA in Microsoft Entra ID, access the https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication[official documentation].
+
+This rule identifies the deactivation of MFA for an Entra ID user account. This modification weakens account security and can lead to the compromise of accounts and other assets.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account and resource owners and confirm whether they are aware of this activity.
+- Correlate with Entra ID Sign-In Logs to identify anomalous sign-in attempts following MFA disablement.
+- This rule does not identify if the user was removed from a conditional access policy (CAP) with MFA requirements.
+    - Instead the rule identifies both legacy and modern MFA disablement through user settings.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+
+- While this activity can be done by administrators, all users must use MFA. The security team should address any potential benign true positive (B-TP), as this configuration can risk the user and domain.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Reactivate multi-factor authentication for the user.
+- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.
+- Implement security defaults https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults[provided by Microsoft].
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.auditlogs" and
+    (azure.auditlogs.operation_name: "Disable Strong Authentication" or
+    (
+        azure.auditlogs.operation_name: "User deleted security info" and
+        azure.auditlogs.properties.additional_details.key: "AuthenticationMethod"
+    )) and event.outcome: (Success or success)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Sub-technique:
+** Name: Multi-Factor Authentication
+** ID: T1556.006
+** Reference URL: https://attack.mitre.org/techniques/T1556/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk.asciidoc
new file mode 100644
index 0000000000..8f18fbc182
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk]]
+=== Entra ID Protection - Risk Detection - Sign-in Risk
+
+Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 1000
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+* https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#risk-types-and-detection
+* https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: Identity
+* Data Source: Azure
+* Data Source: Entra ID
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Use Case: Risk Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+This rule detects sign-in risk detection events via Microsoft Entra ID Protection. It identifies various risk event types such as anonymized IP addresses, unlikely travel, password spray, and more. These events can indicate potential malicious activity or compromised accounts.
+
+
+*Possible investigation steps*
+
+
+- Review the `azure.identityprotection.properties.risk_event_type` field to understand the specific risk event type detected.
+- Check the `azure.identityprotection.properties.risk_level` field to determine the severity of the risk event.
+- Check the `azure.identityprotection.properties.risk_detail` field for additional context on the risk event.
+- Review the `azure.correlation_id` field to correlate this event with other related events in your environment.
+- Review the `azure.identityprotection.properties.additional_info` field for any additional information provided by Entra ID Protection.
+- Review the `azure.identityprotection.properties.detection_timing_type` field to understand when the risk event was detected. Offline detections may indicate a delayed response to a potential threat while real-time detections indicate immediate risk assessment.
+- Check the `azure.identityprotection.properties.user_principal_name` field to identify the user account associated with the risk event. This can help determine if the account is compromised or if the risk event is expected behavior for that user. Triage the user account with other events from Entra ID audit or sign-in logs to identify any suspicious activity or patterns.
+
+
+*False positive analysis*
+
+
+- Users accessing their accounts from anonymized IP addresses, such as VPNs or Tor, may trigger this rule. If this is expected behavior in your environment, consider adjusting the rule or adding exceptions for specific users or IP ranges.
+- Users who frequently travel or access their accounts from different geographic locations may trigger this rule due to the unlikely travel detection mechanism. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users.
+- Users who have recently changed their passwords may trigger this rule due to the password spray detection mechanism. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users.
+
+
+*Response and remediation*
+
+- Investigate the user account associated with the risk event to determine if it has been compromised or if the risk event is expected behavior.
+- If the risk event indicates a compromised account, take appropriate actions such as resetting the password, enabling multi-factor authentication, or disabling the account temporarily.
+- Review authentication material such as primary refresh tokens (PRTs) or OAuth tokens to ensure they have not been compromised. If necessary, revoke these tokens to prevent further access.
+- Implement sign-in risk policies in Entra ID Protection to automatically respond to risk events, such as requiring multi-factor authentication or blocking sign-ins from risky locations.
+- Ensure multi-factor authentication is enabled for all user accounts to provide an additional layer of security against compromised accounts.
+- Consider using high risk detections and conditional access evaluations to enforce stricter security measures for accounts or enable access revocation.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Protection Logs*
+
+To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+*Additional notes*
+
+
+For information on troubleshooting the maximum alerts warning please refer to this https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts[guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.identity_protection" and
+    event.action: "User Risk Detection" and
+    azure.identityprotection.properties.activity: "signin"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk.asciidoc
new file mode 100644
index 0000000000..5872ac5a0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk.asciidoc
@@ -0,0 +1,151 @@
+[[prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk]]
+=== Entra ID Protection - Risk Detection - User Risk
+
+Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 1000
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#risk-types-and-detection
+* https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: Identity
+* Data Source: Azure
+* Data Source: Entra ID
+* Use Case: Identity and Access Audit
+* Use Case: Threat Detection
+* Use Case: Risk Detection
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+This rule detects user risk detection events via Microsoft Entra ID Protection. It identifies various risk event types such as anonymized IP addresses, unlikely travel, password spray, and more. These events can indicate potential malicious activity or compromised accounts.
+
+
+*Possible investigation steps*
+
+
+- Review the `azure.identityprotection.properties.risk_event_type` field to understand the specific risk event type detected.
+- Check the `azure.identityprotection.properties.risk_level` field to determine the severity of the risk event.
+- Check the `azure.identityprotection.properties.risk_detail` field for additional context on the risk event.
+- Review the `azure.correlation_id` field to correlate this event with other related events in your environment.
+- Review the `azure.identityprotection.properties.additional_info` field for any additional information provided by Entra ID Protection.
+- Review the `azure.identityprotection.properties.detection_timing_type` field to understand when the risk event was detected. Offline detections may indicate a delayed response to a potential threat while real-time detections indicate immediate risk assessment.
+- Check the `azure.identityprotection.properties.user_principal_name` field to identify the user account associated with the risk event. This can help determine if the account is compromised or if the risk event is expected behavior for that user. Triage the user account with other events from Entra ID audit or sign-in logs to identify any suspicious activity or patterns.
+
+
+*False positive analysis*
+
+
+- Users accessing their accounts from anonymized IP addresses, such as VPNs or Tor, may trigger this rule. If this is expected behavior in your environment, consider adjusting the rule or adding exceptions for specific users or IP ranges.
+- Users who frequently travel or access their accounts from different geographic locations may trigger this rule due to the unlikely travel detection mechanism. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users.
+- Users who have recently changed their passwords may trigger this rule due to the password spray detection mechanism. If this is expected behavior, consider adjusting the rule or adding exceptions for specific users.
+
+
+*Response and remediation*
+
+- Investigate the user account associated with the risk event to determine if it has been compromised or if the risk event is expected behavior.
+- If the risk event indicates a compromised account, take appropriate actions such as resetting the password, enabling multi-factor authentication, or disabling the account temporarily.
+- Review authentication material such as primary refresh tokens (PRTs) or OAuth tokens to ensure they have not been compromised. If necessary, revoke these tokens to prevent further access.
+- Implement sign-in risk policies in Entra ID Protection to automatically respond to risk events, such as requiring multi-factor authentication or blocking sign-ins from risky locations.
+- Ensure multi-factor authentication is enabled for all user accounts to provide an additional layer of security against compromised accounts.
+- Consider using high risk detections and conditional access evaluations to enforce stricter security measures for accounts or enable access revocation.
+
+
+==== Setup
+
+
+
+*Required Microsoft Entra ID Protection Logs*
+
+To use this rule, ensure that Microsoft Entra ID Protection logs are being collected and streamed into the Elastic Stack via the Azure integration.
+
+
+*Additional notes*
+
+
+For information on troubleshooting the maximum alerts warning please refer to this https://www.elastic.co/guide/en/security/current/alerts-ui-monitor.html#troubleshoot-max-alerts[guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.identity_protection" and
+    event.action: "User Risk Detection" and
+    azure.identityprotection.properties.activity: "user"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell.asciidoc
new file mode 100644
index 0000000000..0b0114d884
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell]]
+=== Exchange Mailbox Export via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 213
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Exchange Mailbox Export via PowerShell*
+
+
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the export operation:
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+  - Contact the account owner and confirm whether they are aware of this activity.
+  - Check if this operation was approved and performed according to the organization's change management policy.
+  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
+- If the operation was completed successfully:
+  - Check if the file is on the path specified in the command.
+  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : "New-MailboxExportRequest"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Local System
+** ID: T1005
+** Reference URL: https://attack.mitre.org/techniques/T1005/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
new file mode 100644
index 0000000000..d7777c81ef
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -0,0 +1,161 @@
+[[prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure]]
+=== Execution via MSSQL xp_cmdshell Stored Procedure
+
+Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Execution via MSSQL xp_cmdshell Stored Procedure*
+
+
+Microsoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.
+
+The xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server service account, which is often privileged.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line to determine if the command executed is potentially harmful or malicious.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of it. If recurrent tasks are being executed using this mechanism, consider adding exceptions — preferably with a full command line.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Ensure that SQL servers are not directly exposed to the internet. If there is a business justification for such, use an allowlist to allow only connections from known legitimate sources.
+- Disable the xp_cmdshell stored procedure.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and
+process.parent.name:"sqlservr.exe" and process.command_line : * and
+(
+  (
+    (process.name.caseless : "cmd.exe" or process.pe.original_file_name : "Cmd.Exe") and
+    not process.args : (
+          \\\\* or diskfree or rmdir or mkdir or dir or DIR or del or rename or bcp or md or ren or REN or send or echo or
+          ECHO or TYPE or type or EXIST or forfiles or sqlcmd or SQLCMD or dtexec or Sort-Object or cat or copy or COPY or
+          move or MOVE or CD\\ or show or rd or powercfg or "C:\SPAN4\DATA\RISKPARAM.SPN" or ("@ECHO" and "@FOR") or
+          ("@echo" and "@for") or (SET and PATH=*) or ("-ExecutionPolicy" and "-File") or MSSQLFDLauncher$DATEV_DBENGINE or
+          (wmic and (cpu or computersystem or logicaldisk or os or ComputerSystem or volume)) or -s\:C\:\\WINDOWS\\SERVIC* or
+          D\:\\* or E\:\\* or F\:\\* or Z\:\\* or "C:\Program Files\Amazon\AWSCLIV2\aws.exe" or C\:\\7-Zip\\7z.exe* or
+          C\:\\FTP* or *\(Get-Item* or C\:\\ProgramData\\Daktronics*
+    ) and
+    not process.command_line : (
+          "\"C:\\Windows\\system32\\cmd.exe\" /c " or
+          "\"C:\\Windows\\System32\\cmd.exe\""
+    )
+  ) or
+  process.name.caseless:("bitsadmin.exe" or "certutil.exe" or "vpnbridge.exe") or
+  process.name:("bitsadmin.exe" or "certutil.exe" or "vpnbridge.exe") or
+  process.pe.original_file_name:("CertUtil.exe" or "bitsadmin.exe" or "vpnbridge.exe")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: SQL Stored Procedures
+** ID: T1505.001
+** Reference URL: https://attack.mitre.org/techniques/T1505/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable.asciidoc
new file mode 100644
index 0000000000..b7b221995b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable.asciidoc
@@ -0,0 +1,198 @@
+[[prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable]]
+=== High Number of Egress Network Connections from Unusual Executable
+
+This rule detects a high number of egress network connections from an unusual executable on a Linux system. This could indicate a command and control (C2) communication attempt, a brute force attack via a malware infection, or other malicious activity. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating High Number of Egress Network Connections from Unusual Executable*
+
+
+In Linux environments, executables can initiate network connections for legitimate purposes. However, adversaries exploit this by deploying malware in temporary directories to establish command and control (C2) channels. The detection rule identifies unusual executables making numerous outbound connections, excluding trusted IP ranges and known benign paths, to flag potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process.executable field to identify the specific executable making the connections and determine if it is known or expected in the environment.
+- Examine the destination.ip field to identify the external IP addresses the executable is attempting to connect to and check if they are known malicious or suspicious.
+- Check the host.os.type and agent.id fields to identify the specific host and agent involved, and gather additional context about the system's role and recent activity.
+- Analyze the @timestamp field to correlate the timing of the connections with other events or activities on the network or host.
+- Cross-reference the identified executable and IP addresses with threat intelligence sources to determine if they are associated with known threats or campaigns.
+- If the executable is determined to be malicious or suspicious, isolate the affected host and perform a deeper forensic analysis to identify any additional indicators of compromise or lateral movement.
+
+
+*False positive analysis*
+
+
+- Executables in temporary directories used by legitimate applications or scripts can trigger alerts. Review the process name and executable path to determine if they are associated with known applications or scripts.
+- Automated scripts or cron jobs that perform network operations might be flagged. Identify these scripts and consider excluding their paths from the rule if they are verified as non-malicious.
+- Development or testing environments often use temporary directories for network operations. If these environments are known and trusted, add their specific paths to the exclusion list.
+- Backup or synchronization tools that use temporary directories for data transfer can generate numerous connections. Verify these tools and exclude their paths if they are confirmed to be safe.
+- Security tools or monitoring agents that operate in temporary directories might be mistakenly flagged. Confirm their legitimacy and exclude their paths to prevent false positives.
+
+
+*Response and remediation*
+
+
+- Isolate the affected host immediately from the network to prevent further potential malicious communication and lateral movement.
+- Terminate the suspicious process identified by the alert to stop any ongoing malicious activity.
+- Conduct a forensic analysis of the affected system to identify any additional indicators of compromise (IOCs) and assess the extent of the infection.
+- Remove any malicious executables or files found in temporary directories such as /tmp, /var/tmp, or /dev/shm to eliminate the threat.
+- Patch and update the affected system to the latest security standards to close any vulnerabilities that may have been exploited.
+- Monitor network traffic for any unusual outbound connections from other systems to detect potential spread or similar threats.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to ensure comprehensive remediation.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.network-*
+| where
+    @timestamp > now() - 1h and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "connection_attempted" and
+    (
+        process.executable like "/tmp/*" or
+        process.executable like "/var/tmp/*" or
+        process.executable like "/dev/shm/*" or
+        process.executable like "/var/log/*" or
+        process.executable like "/sys/*" or
+        process.executable like "/media/*" or
+        process.executable like "/proc/*" or
+        process.executable like "/var/backups/*" or
+        process.executable like "/var/mail/*" or
+        process.executable like "/var/spool/*" or
+        process.executable like "./*" or
+        process.name like ".*"
+    ) and
+    not (
+        cidr_match(destination.ip,
+            "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
+            "192.0.0.0/24", "192.0.0.29/32", "192.0.0.8/32", "192.0.0.9/32",
+            "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+            "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
+            "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
+            "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
+        ) or
+        process.executable like "/tmp/newroot/*" or
+        process.executable like "/tmp/.mount*" or
+        process.executable like "/tmp/go-build*"
+    )
+| keep
+    @timestamp,
+    host.os.type,
+    event.type,
+    event.action,
+    process.name,
+    process.executable,
+    destination.ip,
+    agent.id,
+    host.name
+| stats
+    Esql.event_count = count(),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+    by process.executable
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.event_count > 15
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-iis-http-logging-disabled.asciidoc
new file mode 100644
index 0000000000..320833ecfa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-iis-http-logging-disabled.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-18-14-iis-http-logging-disabled]]
+=== IIS HTTP Logging Disabled
+
+Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 316
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating IIS HTTP Logging Disabled*
+
+
+IIS (Internet Information Services) is a Microsoft web server software used to host websites and web applications on Windows. It provides features for serving dynamic and static content, and can be managed through a graphical interface or command-line tools.
+
+IIS logging is a data source that can be used for security monitoring, forensics, and incident response. It contains mainly information related to requests done to the web server, and can be used to spot malicious activities like webshells. Adversaries can tamper, clear, and delete this data to evade detection, cover their tracks, and slow down incident response.
+
+This rule monitors commands that disable IIS logging.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Verify whether the logs stored in the `C:\inetpub\logs\logfiles\w3svc1` directory were deleted after this action.
+- Check if this operation is done under change management and approved according to the organization's policy.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Re-enable affected logging components, services, and security monitoring.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "appcmd.exe" or ?process.pe.original_file_name == "appcmd.exe") and
+  process.args : "/dontLog*:*True" and
+  not process.parent.name : "iissetup.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-lsass-memory-dump-handle-access.asciidoc
new file mode 100644
index 0000000000..74b92a8330
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-lsass-memory-dump-handle-access.asciidoc
@@ -0,0 +1,177 @@
+[[prebuilt-rule-8-18-14-lsass-memory-dump-handle-access]]
+=== LSASS Memory Dump Handle Access
+
+Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-system.security*
+* logs-windows.forwarded*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656
+* https://twitter.com/jsecurity101/status/1227987828534956033?s=20
+* https://attack.mitre.org/techniques/T1003/001/
+* https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-170105221010.html
+* http://findingbad.blogspot.com/2017/
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Windows Security Event Logs
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating LSASS Memory Dump Handle Access*
+
+
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
+
+Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using https://attack.mitre.org/techniques/T1550/[alternate authentication material].
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- There should be very few or no false positives for this rule. If this activity is expected or noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+- If the process is related to antivirus or endpoint detection and response solutions, validate that it is installed on the correct path and signed with the company's valid digital signature.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Scope compromised credentials and disable the accounts.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+Ensure advanced audit policies for Windows are enabled, specifically:
+Object Access policies https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656[Event ID 4656] (Handle to an Object was Requested)
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+System Audit Policies >
+Object Access >
+Audit File System (Success,Failure)
+Audit Handle Manipulation (Success,Failure)
+```
+
+Also, this event generates only if the object's https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists[SACL] has the required access control entry (ACE) to handle the use of specific access rights.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:"windows" and event.code:"4656" and
+  (
+    winlog.event_data.AccessMask : ("0x1fffff" or "0x1010" or "0x120089" or "0x1F3FFF") or
+    winlog.event_data.AccessMaskDescription : ("READ_CONTROL" or "Read from process memory")
+  ) and
+  winlog.event_data.ObjectName : *\\Windows\\System32\\lsass.exe and
+  not winlog.event_data.ProcessName : (
+      "C:\Windows\System32\wbem\WmiPrvSE.exe" or
+      "C:\Windows\SysWOW64\wbem\WmiPrvSE.exe" or
+      "C:\Windows\System32\dllhost.exe" or
+      "C:\Windows\System32\svchost.exe" or
+      "C:\Windows\System32\msiexec.exe" or
+      "C:\Windows\explorer.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-atypical-travel.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-atypical-travel.asciidoc
new file mode 100644
index 0000000000..1f7731c1f5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-atypical-travel.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-18-14-m365-portal-login-atypical-travel]]
+=== M365 Portal Login (Atypical Travel)
+
+Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft 365 account from an unusual location or behind a VPN.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Threat Detection
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating M365 Portal Login (Atypical Travel)*
+
+
+Microsoft 365 is a cloud-based suite offering productivity tools accessible from anywhere, making it crucial for business operations. Adversaries may exploit this by logging in from uncommon locations, potentially using VPNs to mask their origin. The detection rule identifies successful logins from atypical locations, flagging potential unauthorized access attempts by analyzing login events and user location patterns.
+
+
+*Possible investigation steps*
+
+
+- Review the user associated with these sign-ins to determine if the login attempt was legitimate or if further investigation is needed.
+- Analyze the geographic locations of the logins to identify any patterns or anomalies that may indicate malicious activity.
+- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
+- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
+- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
+- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
+
+
+*False positive analysis*
+
+
+- Users traveling or using VPNs may trigger this alert. Verify with the user if they were traveling or using a VPN at the time of the login attempt.
+- Mobile access may also result in false positives, as users may log in from various locations while on the go.
+
+
+*Response and remediation*
+
+
+- Investigate the login attempt further by checking for any additional context or related events that may provide insight into the user's behavior.
+- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
+- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
+- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit and
+    event.provider:AzureActiveDirectory and
+    event.action:UserLoggedIn and
+    event.outcome:success and
+    o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
+    o365.audit.UserId:(* and not "Not Available") and
+    source.geo.region_iso_code:* and
+    o365.audit.Target.ID:(
+        00000006-0000-0ff1-ce00-000000000000 or
+        4765445b-32c6-49b0-83e6-1d93765276ca
+    ) and not o365.audit.ApplicationId:(
+        29d9ed98-a469-4536-ade2-f981bc1d605e or
+        38aa3b87-a06d-4817-b275-7a316988d93b or
+        a809996b-059e-42e2-9866-db24b99a9782
+    ) and not o365.audit.ExtendedProperties.RequestType:(
+        "Cmsi:Cmsi" or
+        "Consent:Set" or
+        "Login:reprocess" or
+        "Login:resume" or
+        "MessagePrompt:MessagePrompt" or
+        "SAS:EndAuth"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-impossible-travel.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-impossible-travel.asciidoc
new file mode 100644
index 0000000000..30c3c40953
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-m365-portal-login-impossible-travel.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-18-14-m365-portal-login-impossible-travel]]
+=== M365 Portal Login (Impossible Travel)
+
+Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-15m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.huntress.com/blog/time-travelers-busted-how-to-detect-impossible-travel-
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Threat Detection
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Resources: Investigation Guide
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating M365 Portal Login (Impossible Travel)*
+
+
+Microsoft 365's cloud-based services enable global access, but this can be exploited by adversaries logging in from disparate locations within short intervals, indicating potential account compromise. The detection rule identifies such anomalies by analyzing login events for rapid geographic shifts, flagging suspicious activity that may suggest unauthorized access attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the user associated with these sign-ins to determine if the login attempt was legitimate or if further investigation is needed.
+- Analyze the geographic locations of the logins to identify any patterns or anomalies that may indicate malicious activity.
+- Review the ISP information for the login attempts to identify any unusual or suspicious providers.
+- Review the authorization request type to understand the context of the login attempts and whether they align with the user's typical behavior.
+- Analyze the client application used for the login attempts to determine if it is consistent with the user's normal usage patterns (Teams, Office, etc.)
+- Analyze the user-agent associated with the login attempts to identify any unusual or suspicious patterns.
+
+
+*False positive analysis*
+
+
+- Users traveling or using VPNs may trigger this alert. Verify with the user if they were traveling or using a VPN at the time of the login attempt.
+- Mobile access may also result in false positives, as users may log in from various locations while on the go.
+
+
+*Response and remediation*
+
+
+- Investigate the login attempt further by checking for any additional context or related events that may provide insight into the user's behavior.
+- If the login attempt is deemed suspicious, consider implementing additional security measures, such as requiring multi-factor authentication (MFA) for logins from unusual locations.
+- Educate users about the risks of accessing corporate resources from unfamiliar locations and the importance of using secure connections (e.g., VPNs) when doing so.
+- Monitor for any subsequent login attempts from the same location or IP address to identify potential patterns of malicious activity.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit and
+    event.provider:AzureActiveDirectory and
+    event.action:UserLoggedIn and
+    event.outcome:success and
+    o365.audit.Target.Type:(0 or 10 or 2 or 3 or 5 or 6) and
+    o365.audit.UserId:(* and not "Not Available") and
+    source.geo.country_name:* and
+    o365.audit.Target.ID:(
+        00000006-0000-0ff1-ce00-000000000000 or
+        4765445b-32c6-49b0-83e6-1d93765276ca
+    ) and not o365.audit.ApplicationId:(
+        29d9ed98-a469-4536-ade2-f981bc1d605e or
+        38aa3b87-a06d-4817-b275-7a316988d93b or
+        a809996b-059e-42e2-9866-db24b99a9782
+    ) and not o365.audit.ExtendedProperties.RequestType:(
+        "Cmsi:Cmsi" or
+        "Consent:Set" or
+        "Login:reprocess" or
+        "Login:resume" or
+        "MessagePrompt:MessagePrompt" or
+        "SAS:EndAuth"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
new file mode 100644
index 0000000000..3a02db5b6a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score]]
+=== Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
+
+A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 114
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score*
+
+
+The detection leverages a machine learning model, ProblemChild, to identify potentially malicious Windows processes by analyzing patterns and assigning a high probability score to suspicious activities. Adversaries may exploit legitimate processes to evade detection, often using techniques like masquerading. This rule flags high-risk events by focusing on processes with a high malicious probability score or those identified by a blocklist, excluding known benign activities.
+
+
+*Possible investigation steps*
+
+
+- Review the process details flagged by the ProblemChild model, focusing on those with a prediction probability greater than 0.98 or identified by the blocklist.
+- Examine the command-line arguments of the suspicious process to identify any unusual or unexpected patterns, excluding those matching known benign patterns like "*C:\\WINDOWS\\temp\\nessus_*.txt*" or "*C:\\WINDOWS\\temp\\nessus_*.tmp*".
+- Check the parent process of the flagged event to determine if it is a legitimate process or if it has been potentially compromised.
+- Investigate the user account associated with the process to assess if it has been involved in any other suspicious activities or if it has elevated privileges that could be exploited.
+- Correlate the event with other security alerts or logs to identify any related activities or patterns that could indicate a broader attack campaign.
+- Consult threat intelligence sources to determine if the process or its associated indicators are linked to known malicious activities or threat actors.
+
+
+*False positive analysis*
+
+
+- Nessus scan files in the Windows temp directory may trigger false positives due to their temporary nature and frequent legitimate use. Users can mitigate this by adding exceptions for file paths like C:\WINDOWS\temp\nessus_*.txt and C:\WINDOWS\temp\nessus_*.tmp.
+- Legitimate software updates or installations might be flagged if they mimic known malicious patterns. Users should review the process details and whitelist trusted software update processes.
+- System administration tools that perform actions similar to those used in attacks could be misidentified. Users should verify the legitimacy of these tools and exclude them from the rule if they are part of regular administrative tasks.
+- Custom scripts or automation tools that are not widely recognized might be flagged. Users should ensure these scripts are secure and add them to an allowlist if they are part of routine operations.
+- Frequent false positives from specific processes can be managed by adjusting the threshold of the machine learning model or refining the blocklist to better distinguish between benign and malicious activities.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of potential malicious activity.
+- Terminate the suspicious process identified by the ProblemChild model to halt any ongoing malicious actions.
+- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any additional threats.
+- Review and analyze the process execution history and associated files to understand the scope of the compromise and identify any persistence mechanisms.
+- Restore any altered or deleted files from backups, ensuring that the backup is clean and free from malware.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for similar processes and activities to detect and respond to future attempts at masquerading or defense evasion.
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Follow the instructions under the **Installation** section.
+- For this rule to work, complete the instructions through **Configure the ingest pipeline**.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or
+blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Masquerade Task or Service
+** ID: T1036.004
+** Reference URL: https://attack.mitre.org/techniques/T1036/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
new file mode 100644
index 0000000000..8f0688dcf5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score]]
+=== Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score
+
+A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 12
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score*
+
+
+The detection leverages a machine learning model to identify potentially suspicious Windows processes with a low likelihood of being malicious, focusing on defense evasion tactics like masquerading. Adversaries may exploit legitimate processes to bypass security measures. This rule flags such events, excluding known benign patterns, to highlight potential threats for further analysis.
+
+
+*Possible investigation steps*
+
+
+- Review the process details where the problemchild.prediction is 1 and the prediction_probability is less than or equal to 0.98 to understand why the process was flagged as suspicious.
+- Check if the process is listed in the blocklist_label as 1, indicating it has been identified as malicious by the model's blocklist.
+- Investigate the command-line arguments of the process to identify any unusual or unexpected patterns, excluding known benign patterns such as those involving "C:\WINDOWS\temp\nessus_*.txt" or "C:\WINDOWS\temp\nessus_*.tmp".
+- Correlate the flagged process with other system events or logs to determine if it is part of a larger pattern of suspicious activity, focusing on defense evasion tactics like masquerading.
+- Assess the parent process and any child processes spawned by the suspicious process to identify potential lateral movement or further malicious activity.
+- Consult threat intelligence sources to see if the process or its associated indicators have been reported in recent threat reports or advisories.
+
+
+*False positive analysis*
+
+
+- Nessus scan files in the Windows temp directory may trigger false positives. Exclude paths like C:\WINDOWS\temp\nessus_*.txt and C:\WINDOWS\temp\nessus_*.tmp to prevent these benign events from being flagged.
+- Legitimate software updates or installations might mimic suspicious behavior. Monitor and document regular update schedules to differentiate between expected and unexpected activities.
+- System administration scripts that automate tasks can appear suspicious. Identify and whitelist these scripts if they are part of routine operations to avoid unnecessary alerts.
+- Custom in-house applications may not be recognized by the model. Work with IT to catalog these applications and create exceptions where necessary to reduce false positives.
+- Regularly review and update the blocklist and exception rules to ensure they reflect the current environment and known benign activities.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent potential lateral movement by the adversary exploiting the masquerading technique.
+- Terminate the suspicious process identified by the machine learning model to halt any ongoing malicious activity.
+- Conduct a thorough review of the process's parent and child processes to identify any additional suspicious activities or related processes that may require termination.
+- Restore the system from a known good backup if any malicious activity is confirmed, ensuring that the backup is free from compromise.
+- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
+- Implement enhanced monitoring for similar masquerading attempts by adjusting alert thresholds or adding specific indicators of compromise (IOCs) related to the detected event.
+- Escalate the incident to the security operations center (SOC) or relevant security team for further analysis and to determine if additional systems are affected.
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Follow the instructions under the **Installation** section.
+- For this rule to work, complete the instructions through **Configure the ingest pipeline**.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where ((problemchild.prediction == 1 and problemchild.prediction_probability <= 0.98) or
+blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Masquerade Task or Service
+** ID: T1036.004
+** Reference URL: https://attack.mitre.org/techniques/T1036/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
new file mode 100644
index 0000000000..c1e5d02284
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account]]
+=== MFA Deactivation with no Re-Activation for Okta User Account
+
+Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-okta.system*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 6h
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Tactic: Persistence
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Domain: Cloud
+* Resources: Investigation Guide
+
+*Version*: 417
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating MFA Deactivation with no Re-Activation for Okta User Account*
+
+
+MFA is used to provide an additional layer of security for user accounts. An adversary may achieve MFA deactivation for an Okta user account to achieve persistence.
+
+This rule fires when an Okta user account has MFA deactivated and no subsequent MFA reactivation is observed within 12 hours.
+
+
+*Possible investigation steps:*
+
+
+- Identify the entity related to the alert by reviewing `okta.target.alternate_id`, `okta.target.id` or `user.target.full_name` fields. This should give the username of the account being targeted. Verify if MFA is deactivated for the target entity.
+- Using the `okta.target.alternate_id` field, search for MFA re-activation events where `okta.event_type` is `user.mfa.factor.activate`. Note if MFA re-activation attempts were made against the target.
+- Identify the actor performing the deactivation by reviewing `okta.actor.alternate_id`, `okta.actor.id` or `user.full_name` fields. This should give the username of the account performing the action. Determine if deactivation was performed by a separate user.
+- Review events where `okta.event_type` is `user.authenticate*` to determine if the actor or target accounts had suspicious login activity.
+    - Geolocation details found in `client.geo*` related fields may be useful in determining if the login activity was suspicious for this user.
+- Examine related administrative activity by the actor for privilege misuse or suspicious changes.
+
+
+*False positive steps:*
+
+
+- Determine with the target user if MFA deactivation was expected.
+- Determine if MFA is required for the target user account.
+
+
+*Response and remediation:*
+
+
+- If the MFA deactivation was not expected, consider deactivating the user
+    - This should be followed by resetting the user's password and re-enabling MFA.
+- If the MFA deactivation was expected, consider adding an exception to this rule to filter false positives.
+- Investigate the source of the attack. If a specific machine or network is compromised, additional steps may need to be taken to address the issue.
+- Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.
+- Check if the compromised account was used to access or alter any sensitive data, applications or systems.
+- Review the client user-agent to determine if it's a known custom application that can be whitelisted.
+
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.target.id with maxspan=12h
+    [any where event.dataset == "okta.system" and okta.event_type in ("user.mfa.factor.deactivate", "user.mfa.factor.reset_all")
+        and okta.outcome.reason != "User reset SECURITY_QUESTION factor" and okta.outcome.result == "SUCCESS"]
+    ![any where event.dataset == "okta.system" and okta.event_type == "user.mfa.factor.activate"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Sub-technique:
+** Name: Multi-Factor Authentication
+** ID: T1556.006
+** Reference URL: https://attack.mitre.org/techniques/T1556/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned.asciidoc
new file mode 100644
index 0000000000..c3a30b8edb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned.asciidoc
@@ -0,0 +1,125 @@
+[[prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned]]
+=== Microsoft 365 Global Administrator Role Assigned
+
+In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator / Company Administrator is a role that enables users to have access to all administrative features in Entra ID and services that use Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Adversaries can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#global-administrator
+* https://learn.microsoft.com/en-us/purview/audit-log-activities
+* https://www.blackhat.com/us-24/briefings/schedule/#unoauthorized-a-technique-to-privilege-escalation-to-global-administrator-39231
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating Microsoft 365 Global Administrator Role Assigned*
+
+
+The Microsoft 365 Global Administrator role grants comprehensive administrative access across Entra ID and services such as Microsoft 365 Defender, Exchange, SharePoint, and Skype for Business. Adversaries who compromise an account may assign this role to themselves or other users to ensure persistent and privileged access. This rule identifies successful assignments of this role by inspecting audit logs from Azure Active Directory (Entra ID) where the role display name matches "Administrator."
+
+
+*Possible investigation steps*
+
+
+- Review the `user.id` and `user.name` fields to determine who performed the role assignment. Assess whether this user normally has permissions to modify high-privilege roles.
+- Confirm the `event.action` is `"Add member to role."` and that the `Role_DisplayName.NewValue` is `"Global Administrator"` or a similarly privileged role.
+- Review the `user.target.id` and `user.target.name` fields to identify the user or service principal that received the role.
+- Inspect `o365.audit.ExtendedProperties.additionalDetails` for context on how the action was performed (e.g., via Admin Portal, Graph API).
+- Pivot to sign-in logs for the assigning account to check for recent anomalies such as logins from new geolocations, unrecognized devices, or suspicious IP ranges.
+- Investigate if the account assignment occurred outside of known change windows, during non-business hours, or by a user with no change history.
+- Correlate with other role assignments or directory changes to check for broader role abuse or privilege escalation campaigns.
+
+
+*False positive analysis*
+
+
+- Role assignments by IT administrators as part of routine maintenance or incident response may appear suspicious in environments without change tracking or ticket correlation.
+- PIM (Privileged Identity Management) activations may temporarily elevate accounts to Global Administrator and then revoke the role afterward.
+- Onboarding processes or internal audits may require temporary elevation to Global Administrator for legitimate users.
+- Automation tools and scripts may trigger this alert if misconfigured to assign Global Administrator privileges during provisioning or sync jobs.
+
+
+*Response and remediation*
+
+
+- If the assignment is unapproved or suspicious, immediately revoke the Global Administrator role from the assigned user or service principal.
+- Reset credentials and initiate containment steps for the assigning account, especially if compromise is suspected.
+- Enable or verify enforcement of MFA for both assigning and assigned accounts.
+- Review Azure AD activity logs for additional signs of privilege misuse or suspicious directory changes.
+- Notify the appropriate identity and security operations teams to investigate further and begin incident response procedures.
+- Limit the number of Global Administrator accounts and enforce role-based access control (RBAC) using least privilege principles.
+- Consider implementing conditional access policies to limit role assignment actions to specific networks, devices, or user groups.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:o365.audit
+    and event.code:"AzureActiveDirectory"
+    and event.action:"Add member to role."
+    and event.outcome: "success"
+    and o365.audit.ModifiedProperties.Role_DisplayName.NewValue: (
+        "Global Administrator" or "Company Administrator"
+    )
+    and o365.audit.AzureActiveDirectoryEventType: 1
+    and o365.audit.RecordType: 8
+    and not o365.audit.Target.Type: (4 or 5 or 6)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
new file mode 100644
index 0000000000..a477e4a888
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application]]
+=== Microsoft 365 Illicit Consent Grant via Registered Application
+
+Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-o365**
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices
+* https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide
+* https://www.cloud-architekt.net/detection-and-mitigation-consent-grant-attacks-azuread/
+* https://docs.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth#how-to-detect-risky-oauth-apps
+* https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+* Tactic: Credential Access
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 Illicit Consent Grant via Registered Application*
+
+
+Adversaries may register a malicious application in Microsoft Entra ID and trick users into granting excessive permissions via OAuth consent. These apps can access sensitive Microsoft 365 data—such as mail, profiles, and files—on behalf of the user once consent is granted. This activity is often initiated through spearphishing campaigns that direct the user to a pre-crafted OAuth consent URL.
+
+This rule identifies a new consent grant to an application using Microsoft 365 audit logs. Additionally, this is a New Terms rule that will only trigger if the user and client ID have not been seen doing this activity in the last 14 days.
+
+
+*Possible investigation steps*
+
+
+- **Review the app in Entra ID**:
+  - Go to **Enterprise Applications** in the Azure portal.
+  - Search for the `AppId` or name from `o365.audit.ObjectId`.
+  - Review granted API permissions and whether admin consent was required.
+  - Check the `Publisher` and `Verified` status.
+
+- **Assess the user who granted consent**:
+  - Investigate `o365.audit.UserId` (e.g., `terrance.dejesus@...`) for signs of phishing or account compromise.
+  - Check if the user was targeted in recent phishing simulations or campaigns.
+  - Review the user’s sign-in logs for suspicious geolocation, IP, or device changes.
+
+- **Determine scope and risk**:
+  - Use the `ConsentContext_IsAdminConsent` and `ConsentContext_OnBehalfOfAll` flags to assess privilege level.
+  - If `offline_access` or `Mail.Read` was granted, consider potential data exposure.
+  - Cross-reference affected `Target` objects with known business-critical assets or data owners.
+
+- **Correlate additional telemetry**:
+  - Review logs from Defender for Cloud Apps (MCAS), Microsoft Purview, or other DLP tooling for unusual access patterns.
+  - Search for `AppId` across your tenant to determine how widely it's used.
+
+
+*False positive analysis*
+
+
+- Not all consent grants are malicious. Verify if the app is business-approved, listed in your app catalog, or commonly used by users in that role or department.
+- Consent reasons like `WindowsAzureActiveDirectoryIntegratedApp` could relate to integrated services, though these still require verification.
+
+
+*Response and remediation*
+
+
+- **If the app is confirmed malicious**:
+  - Revoke OAuth consent using the https://learn.microsoft.com/en-us/graph/api/oauth2permissiongrant-delete[Microsoft Graph API].
+  - Remove any related service principals from Entra ID.
+  - Block the app via the Conditional Access "Grant" control or Defender for Cloud Apps policies.
+  - Revoke refresh tokens and require reauthentication for affected users.
+  - Notify end-users and IT of the potential exposure.
+  - Activate your phishing or OAuth abuse response playbook.
+
+- **Prevent future misuse**:
+  - Enable the https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-admin-consent-workflow[Admin consent workflow] to restrict user-granted consent.
+  - Audit and reduce overprivileged applications in your environment.
+  - Consider using Defender for Cloud Apps OAuth app governance.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "o365.audit"
+  and o365.audit.Actor.Type: 5
+  and event.action: "Consent to application."
+  and event.outcome: "success"
+  and o365.audit.Target.Type: (0 or 2 or 3 or 9 or 10)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
new file mode 100644
index 0000000000..f14de4686b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client]]
+=== Microsoft 365 OAuth Phishing via Visual Studio Code Client
+
+Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-o365.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-25m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Domain: SaaS
+* Data Source: Microsoft 365
+* Data Source: Microsoft 365 Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft 365 OAuth Phishing via Visual Studio Code Client*
+
+
+This rule identifies successful Microsoft 365 sign-ins where the Visual Studio Code first-party application (`ApplicationId = aebc6443-996d-45c2-90f0-388ff96faa56`) was used to initiate an OAuth 2.0 authorization code flow targeting Microsoft Graph. While this is common for legitimate development workflows, it has been abused in real-world phishing campaigns to trick users into returning authorization codes that attackers can exchange for access tokens.
+
+The behavior is typically seen in targeted attacks where users are lured into clicking a Microsoft login URL that redirects to a legitimate Microsoft URI (such as `insiders.vscode.dev`) and displays an OAuth code. If the user returns this code (e.g., via Signal, WhatsApp, or email), the attacker can use it to gain access to the user’s data via Microsoft Graph APIs — all without prompting for explicit consent or MFA, especially when default or pre-consented apps are abused.
+
+
+*Possible investigation steps*
+
+
+- Review `user.name` or `o365.audit.UserId` to identify the impacted account.
+- Validate whether the user expected to authorize the Visual Studio Code app at the time of the event.
+- Check if `o365.audit.ActorIpAddress` is an unexpected or geolocated IP — especially outside of corporate ranges or from proxy networks.
+- Look at `user_agent.original` and `o365.audit.DeviceProperties` to determine the device and browser involved — known attacker flows often show Chrome + MacOS or headless browser variants.
+- Confirm the `Target.ID` (Microsoft Graph: `00000003-0000-0000-c000-000000000000`) matches the scope of access the attacker might attempt.
+- Check for follow-up access events or mailbox enumeration using the Graph API from unfamiliar service principals or devices.
+- Review the `ExtendedProperties.RequestType` = `OAuth2:Authorize` and `ResultStatusDetail` = `Redirect` — this indicates that the user was redirected after authorization, which typically exposes the OAuth `code`.
+
+
+*False positive analysis*
+
+
+- Developers or IT users intentionally using Visual Studio Code to connect to Microsoft 365 may trigger this rule.
+- Legitimate Visual Studio Code extensions that sync or query Graph API data (e.g., calendars, tasks, cloud-hosted notebooks).
+- Enterprise use cases where VS Code is used for integrated identity workflows.
+- Exclude known user agents and hosts that regularly use Visual Studio Code against Graph.
+- Whitelist specific source IPs or devices tied to developer machines.
+- Correlate with user context and behavior — if the user has no reason to be developing or testing code, the event may be more suspicious.
+- Add exception rules for managed devices or corporate laptops using this flow regularly.
+
+
+*Response and remediation*
+
+
+- Reach out to the user to confirm if they expected this login or may have shared an OAuth code.
+- Suspend or reset credentials if the login appears suspicious or if the code was likely returned to a third party.
+- Review recent Microsoft Graph activity (email, file access, Teams) for this user and service principal.
+- Block or restrict future use of OAuth tokens from unknown apps or IPs via Conditional Access.
+- Add alerts for `ApplicationId = aebc6443-...` combined with low-reputation IPs or unexpected device fingerprints.
+- Require MFA and Conditional Access for all OAuth flows — even for Microsoft first-party apps.
+- Disable or restrict app consent for users, and require admin approval for Graph API scopes.
+- Educate users about OAuth-based phishing techniques — especially those that ask users to share "codes" after clicking a Microsoft login link.
+- Regularly audit `ApplicationId`, `RequestType`, and `ResultStatusDetail` values in `o365.audit` to spot anomalous usage patterns.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "o365.audit"
+    and event.action: "UserLoggedIn"
+    and o365.audit.ApplicationId: "aebc6443-996d-45c2-90f0-388ff96faa56"
+    and o365.audit.Target.ID: "00000003-0000-0000-c000-000000000000"
+    and o365.audit.ExtendedProperties.RequestType: "OAuth2:Authorize"
+    and o365.audit.ExtendedProperties.ResultStatusDetail: "Redirect"
+    and o365.audit.UserType: ("0" or "2" or "3" or "5" or "6" or "10")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
new file mode 100644
index 0000000000..85c936261b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application]]
+=== Microsoft Entra ID Illicit Consent Grant via Registered Application
+
+Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-azure*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices
+* https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/detect-and-remediate-illicit-consent-grants?view=o365-worldwide
+* https://www.cloud-architekt.net/detection-and-mitigation-consent-grant-attacks-azuread/
+* https://docs.microsoft.com/en-us/defender-cloud-apps/investigate-risky-oauth#how-to-detect-risky-oauth-apps
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+* Tactic: Credential Access
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Entra ID Illicit Consent Grant via Registered Application*
+
+
+Adversaries may register a malicious application in Microsoft Entra ID and trick users into granting excessive permissions via OAuth consent. These applications can access sensitive data—such as mail, profiles, or files—on behalf of the user once consent is granted. This is commonly delivered via spearphishing links that prompt users to approve permissions for seemingly legitimate applications.
+
+This rule identifies a new consent grant event based on Azure audit logs where the application was granted access with potentially risky scopes, such as offline_access, Mail.Read, or User.Read, and may include admin consent or tenant-wide delegation.
+
+This is a New Terms rule that will only trigger if the user and client ID have not been seen doing this activity in the last 14 days.
+
+
+*Possible investigation steps*
+
+
+- Review `azure.auditlogs.properties.additional_details.value` to identify the AppId and User-Agent values to determine which application was granted access and how the request was initiated. Pivot on the AppId in the Azure portal under Enterprise Applications to investigate further.
+- Review `azure.auditlogs.properties.initiated_by.user.userPrincipalName` to identify the user who approved the application. Investigate their recent activity for signs of phishing, account compromise, or anomalous behavior during the timeframe of the consent.
+- Review `azure.auditlogs.properties.initiated_by.user.ipAddress` to assess the geographic source of the consent action. Unexpected locations or IP ranges may indicate adversary-controlled infrastructure.
+- Review `azure.auditlogs.properties.target_resources.display_name` to evaluate whether the application name is familiar, expected, or potentially spoofing a known service.
+- Review `azure.auditlogs.properties.target_resources.modified_properties.display_name` to inspect key indicators of elevated privilege or risk, including:
+  - ConsentContext.IsAdminConsent to determine if the application was granted tenant-wide admin access.
+  - ConsentContext.OnBehalfOfAll to identify whether the app was granted permissions on behalf of all users in the tenant.
+  - ConsentAction.Permissions to evaluate the specific scopes and data access the application requested.
+  - ConsentAction.Reason to understand if Microsoft flagged the activity or if any reason was recorded by the platform.
+  - TargetId.ServicePrincipalNames to confirm the service principal associated with the granted permissions.
+- Review `azure.tenant_id` to confirm the activity originated from your tenant and is not related to a cross-tenant application.
+- Review `@timestamp` and `azure.auditlogs.properties.correlation_id` to pivot into related sign-in, token usage, or application activity for further context.
+
+
+*False positive analysis*
+
+
+- Some applications may request high-privilege scopes for legitimate purposes. Validate whether the application is verified, developed by Microsoft, or approved internally by your organization.
+- Review publisher verification, app ownership, and scope alignment with the intended business use case.
+
+
+*Response and remediation*
+
+
+- Revoke the application’s OAuth grant using Graph API or PowerShell. Use the Remove-AzureADOAuth2PermissionGrant cmdlet.
+- Remove the associated service principal from Azure AD.
+- Reset credentials or revoke tokens for affected users.
+- Block the application via Conditional Access or Defender for Cloud Apps policies.
+- Enable the Admin Consent Workflow in Azure AD to prevent unsanctioned user approvals in the future.
+- Report any malicious applications to Microsoft to protect other tenants.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.auditlogs" and
+  (
+    azure.auditlogs.operation_name:"Consent to application"
+    or event.action:"Consent to application"
+  )
+  and event.outcome: "success"
+  and azure.auditlogs.properties.additional_details.key: "AppId"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal Application Access Token
+** ID: T1528
+** Reference URL: https://attack.mitre.org/techniques/T1528/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity.asciidoc
new file mode 100644
index 0000000000..c6153db798
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity.asciidoc
@@ -0,0 +1,119 @@
+[[prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity]]
+=== Microsoft Entra ID User Reported Suspicious Activity
+
+Identifies suspicious activity reported by users in Microsoft Entra ID where users have reported suspicious activity related to their accounts, which may indicate potential compromise or unauthorized access attempts. Reported suspicious activity typically occurs during the authentication process and may involve various authentication methods, such as password resets, account recovery, or multi-factor authentication challenges. Adversaries may attempt to exploit user accounts by leveraging social engineering techniques or other methods to gain unauthorized access to sensitive information or resources.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-azure.auditlogs-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://chris-brumm.medium.com/microsoft-entra-mfa-fraud-deep-dive-7764fd8f76ad
+* https://janbakker.tech/report-suspicious-activity-fraud-alert-for-azure-mfa/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Audit Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+* Willem D'Haese
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating Microsoft Entra ID User Reported Suspicious Activity*
+
+
+This rule detects when a user in Microsoft Entra ID reports suspicious activity associated with their account. This feature is often used to report MFA fatigue or unsolicited push notifications, and is logged during authentication flows involving methods like Microsoft Authenticator. Such events may indicate that an attacker attempted unauthorized access and triggered a push that was denied or flagged by the user.
+
+
+*Possible investigation steps*
+
+
+- Review the `azure.auditlogs.identity` field to identify the reporting user.
+- Confirm that `event.action` is `"Suspicious activity reported"` and the result was `"success"`.
+- Check the `azure.auditlogs.properties.additional_details` array for `AuthenticationMethod`, which shows how the login attempt was performed (e.g., `PhoneAppNotification`).
+- Look at the `azure.auditlogs.properties.initiated_by.user.userPrincipalName` and `displayName` to confirm which user reported the suspicious activity.
+- Investigate recent sign-in activity (`signinlogs`) for the same user. Focus on:
+  - IP address geolocation and ASN.
+  - Device, operating system, and browser.
+  - MFA prompt patterns or unusual login attempts.
+- Determine whether the user actually initiated a login attempt, or if it was unexpected and aligns with MFA fatigue or phishing attempts.
+- Correlate this report with any risky sign-in detections, conditional access blocks, or password resets in the past 24–48 hours.
+
+
+*False positive analysis*
+
+
+- Users unfamiliar with MFA push notifications may mistakenly report legitimate sign-in attempts.
+- Shared accounts or device switching can also trigger unintended notifications.
+- Legitimate travel or network changes might confuse users into thinking activity was malicious.
+
+
+*Response and remediation*
+
+
+- Contact the user to validate the suspicious activity report and assess whether they were targeted or tricked by a malicious actor.
+- If the report is confirmed to be valid:
+  - Reset the user’s credentials immediately.
+  - Revoke active sessions and refresh tokens.
+  - Review their activity across Microsoft 365 services for signs of compromise.
+- If other users report similar behavior around the same time, assess for a broader MFA fatigue campaign or targeted phishing.
+- Consider tuning conditional access policies to require number matching or stronger MFA mechanisms.
+- Educate users on reporting suspicious MFA prompts and following up with IT/security teams promptly.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.auditlogs"
+    and azure.auditlogs.operation_name: "Suspicious activity reported"
+    and azure.auditlogs.properties.additional_details.key: "AuthenticationMethod"
+    and azure.auditlogs.properties.target_resources.*.type: "User"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..3bb93fa668
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes]]
+=== Microsoft Exchange Worker Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
+* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
+* https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 313
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Microsoft Exchange Worker Spawning Suspicious Processes*
+
+
+Microsoft Exchange Server uses the worker process (w3wp.exe) to handle web requests, often running under specific application pools. Adversaries exploit this by executing malicious scripts or commands, potentially via web shells, to gain unauthorized access or execute arbitrary code. The detection rule identifies unusual child processes like command-line interpreters spawned by w3wp.exe, signaling possible exploitation or backdoor activity.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to confirm the parent process is w3wp.exe and check if the process arguments include "MSExchange*AppPool" to ensure the alert is relevant to Microsoft Exchange.
+- Examine the child process details, focusing on the process names and original file names such as cmd.exe, powershell.exe, pwsh.exe, and powershell_ise.exe, to identify any unauthorized or unexpected command-line activity.
+- Investigate the timeline of events leading up to the alert, including any preceding or subsequent processes, to understand the context and potential impact of the suspicious activity.
+- Check for any associated network activity or connections initiated by the suspicious processes to identify potential data exfiltration or communication with external command and control servers.
+- Review recent changes or access logs on the affected Exchange server to identify any unauthorized access attempts or modifications that could indicate exploitation or the presence of a web shell.
+- Correlate the alert with other security events or logs from data sources like Elastic Endgame, Elastic Defend, Sysmon, Microsoft Defender for Endpoint, or SentinelOne to gather additional context and corroborate findings.
+- Assess the risk and impact of the detected activity, considering the severity and risk score, and determine appropriate response actions, such as isolating the affected system or conducting a deeper forensic analysis.
+
+
+*False positive analysis*
+
+
+- Routine administrative tasks may trigger the rule if administrators use command-line tools like cmd.exe or powershell.exe for legitimate maintenance. To manage this, create exceptions for known administrative accounts or specific IP addresses that regularly perform these tasks.
+- Scheduled tasks or scripts that run under the MSExchangeAppPool context might spawn command-line interpreters as part of their normal operation. Identify these tasks and exclude them by specifying their unique process arguments or command lines.
+- Monitoring or backup software that interacts with Exchange Server could inadvertently trigger the rule. Review the software's documentation to confirm its behavior and exclude its processes by name or hash if they are verified as safe.
+- Custom applications or integrations that interact with Exchange Server and use command-line tools for automation may also cause false positives. Work with application developers to understand these interactions and exclude them based on process names or specific command-line patterns.
+- If a known security tool or script is used to test Exchange Server's security posture, it might mimic suspicious behavior. Document these tools and exclude their processes during scheduled testing periods to avoid false alerts.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected Microsoft Exchange Server from the network to prevent further unauthorized access or lateral movement.
+- Terminate any suspicious processes identified as being spawned by w3wp.exe, such as cmd.exe or powershell.exe, to halt any ongoing malicious activity.
+- Conduct a thorough review of the server's application pools and web directories to identify and remove any unauthorized web shells or scripts.
+- Restore the server from a known good backup taken before the suspicious activity was detected to ensure system integrity.
+- Apply the latest security patches and updates to the Microsoft Exchange Server to mitigate known vulnerabilities and prevent exploitation.
+- Monitor network traffic and server logs for any signs of continued or attempted exploitation, focusing on unusual outbound connections or repeated access attempts.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems have been compromised.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
+  (
+    (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE"))
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request.asciidoc
new file mode 100644
index 0000000000..262ec7fe7c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request.asciidoc
@@ -0,0 +1,125 @@
+[[prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request]]
+=== Microsoft Graph First Occurrence of Client Request
+
+This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-azure.graphactivitylogs-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Graph
+* Data Source: Microsoft Graph Activity Logs
+* Resources: Investigation Guide
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Graph First Occurrence of Client Request*
+
+
+This rule detects the first observed occurrence of a Microsoft Graph API request by a specific client application ID (`azure.graphactivitylogs.properties.app_id`) in combination with a user principal object ID (`azure.graphactivitylogs.properties.user_principal_object_id`) and tenant ID (`azure.tenant_id`) within the last 14 days. This may indicate unauthorized access following a successful phishing attempt, token theft, or abuse of OAuth workflows.
+
+Adversaries frequently exploit legitimate Microsoft or third-party application IDs to avoid raising suspicion during initial access. By using pre-consented or trusted apps to interact with Microsoft Graph, attackers can perform actions on behalf of users without triggering conventional authentication alerts or requiring additional user interaction.
+
+
+*Possible investigation steps*
+
+
+- Review `azure.graphactivitylogs.properties.user_principal_object_id` and correlate with recent sign-in logs for the associated user.
+- Determine whether `azure.graphactivitylogs.properties.app_id` is a known and approved application in your environment.
+- Investigate the `user_agent.original` field for signs of scripted access (e.g., automation tools or libraries).
+- Check the source IP address (`source.ip`) and geolocation data (`source.geo.*`) for unfamiliar origins.
+- Inspect `azure.graphactivitylogs.properties.scopes` to understand the level of access being requested by the app.
+- Examine any follow-up Graph API activity from the same `app_id` or `user_principal_object_id` for signs of data access or exfiltration.
+- Correlate with device or session ID fields (`azure.graphactivitylogs.properties.c_sid`, if present) to detect persistent or repeat activity.
+
+
+*False positive analysis*
+
+
+- First-time use of a legitimate Microsoft or enterprise-approved application.
+- Developer or automation workflows initiating new Graph API requests.
+- Valid end-user activity following device reconfiguration or new client installation.
+- Maintain an allowlist of expected `app_id` values and known developer tools.
+- Suppress detections from known good `user_agent.original` strings or approved source IP ranges.
+- Use device and identity telemetry to distinguish trusted vs. unknown activity sources.
+- Combine with session risk or sign-in anomaly signals where available.
+
+
+*Response and remediation*
+
+
+- Reach out to the user and verify whether they authorized the application access.
+- Revoke active OAuth tokens and reset credentials if unauthorized use is confirmed.
+- Search for additional Graph API calls made by the same `app_id` or `user_principal_object_id`.
+- Investigate whether sensitive resources (mail, files, Teams, contacts) were accessed.
+- Apply Conditional Access policies to limit Graph API access by app type, IP, or device state.
+- Restrict user consent for third-party apps and enforce admin approval workflows.
+- Monitor usage of new or uncommon `app_id` values across your tenant.
+- Provide user education on OAuth phishing tactics and reporting suspicious prompts.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.graphactivitylogs"
+    and event.type: "access"
+    and azure.graphactivitylogs.properties.c_idtyp: "user"
+    and azure.graphactivitylogs.properties.client_auth_method: 0
+    and http.response.status_code: 200
+    and url.domain: "graph.microsoft.com"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path.asciidoc
new file mode 100644
index 0000000000..7939783b9f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path.asciidoc
@@ -0,0 +1,163 @@
+[[prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path]]
+=== Microsoft Management Console File from Unusual Path
+
+Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/grimresource
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Windows Security Event Logs
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+* Data Source: Sysmon
+
+*Version*: 313
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Microsoft Management Console File from Unusual Path*
+
+
+Microsoft Management Console (MMC) is a Windows utility that provides a framework for system management. Adversaries may exploit MMC by executing .msc files from non-standard directories to bypass security controls. The detection rule identifies such anomalies by monitoring the execution of mmc.exe with .msc files from untrusted paths, flagging potential unauthorized access or execution attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the process execution details to confirm the path of the mmc.exe and the .msc file being executed. Check if the path is indeed non-standard or untrusted as per the query criteria.
+- Investigate the origin of the .msc file by examining file creation and modification timestamps, and check for any recent changes or unusual activity in the directory where the file resides.
+- Analyze the user account associated with the process execution to determine if the activity aligns with their typical behavior or if it appears suspicious.
+- Check for any related alerts or logs around the same timeframe that might indicate lateral movement or other malicious activities, such as unusual network connections or file access patterns.
+- Correlate the event with other data sources mentioned in the rule, such as Microsoft Defender for Endpoint or Crowdstrike, to gather additional context or corroborating evidence of potential malicious activity.
+- Assess the risk and impact of the execution by determining if the .msc file has any known malicious signatures or if it attempts to perform unauthorized actions on the system.
+
+
+*False positive analysis*
+
+
+- Legitimate administrative tasks may trigger this rule if system administrators execute .msc files from custom directories. To manage this, create exceptions for known administrative scripts or tools that are regularly used from non-standard paths.
+- Software installations or updates might involve executing .msc files from temporary or installation directories. Monitor these activities and whitelist specific installation paths if they are verified as safe and part of routine operations.
+- Automated scripts or third-party management tools could execute .msc files from non-standard locations as part of their normal operation. Identify these tools and add their execution paths to the exception list to prevent unnecessary alerts.
+- Development or testing environments may involve running .msc files from various directories for testing purposes. Establish a separate monitoring policy for these environments or exclude known development paths to reduce false positives.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Terminate any suspicious processes related to mmc.exe executing from untrusted paths to halt potential malicious activity.
+- Conduct a thorough review of the system's recent activity logs to identify any additional indicators of compromise or related suspicious activities.
+- Remove any unauthorized .msc files found in non-standard directories and ensure they are not reintroduced.
+- Restore the system from a known good backup if any unauthorized changes or damage is detected.
+- Update and patch the system to the latest security standards to close any vulnerabilities that may have been exploited.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.executable : (
+    "?:\\Windows\\System32\\mmc.exe",
+
+    /* Crowdstrike specific condition as it uses NT Object paths */
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\mmc.exe"
+  ) and
+  process.args : "*.msc" and
+  not process.args : (
+        "?:\\Windows\\System32\\*.msc",
+        "?:\\Windows\\SysWOW64\\*.msc",
+        "?:\\Program files\\*.msc",
+        "?:\\Program Files (x86)\\*.msc",
+        "?:\\Windows\\ADFS\\Microsoft.IdentityServer.msc"
+  ) and
+  not process.command_line : (
+    "C:\\Windows\\system32\\mmc.exe eventvwr.msc /s",
+    "mmc.exe eventvwr.msc /s",
+    "\"C:\\Windows\\System32\\mmc.exe\" CompMgmt.msc*"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
+* Sub-technique:
+** Name: JavaScript
+** ID: T1059.007
+** Reference URL: https://attack.mitre.org/techniques/T1059/007/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: MMC
+** ID: T1218.014
+** Reference URL: https://attack.mitre.org/techniques/T1218/014/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-modification-of-wdigest-security-provider.asciidoc
new file mode 100644
index 0000000000..1250507ab2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-modification-of-wdigest-security-provider.asciidoc
@@ -0,0 +1,139 @@
+[[prebuilt-rule-8-18-14-modification-of-wdigest-security-provider]]
+=== Modification of WDigest Security Provider
+
+Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
+* https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019
+* https://frsecure.com/compromised-credentials-response-playbook
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 214
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Modification of WDigest Security Provider*
+
+
+In Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default, which is no longer the case with newer Windows versions.
+
+Still, attackers can force WDigest to store the passwords insecurely on the memory by modifying the `HKLM\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\UseLogonCredential` registry key. This activity is commonly related to the execution of credential dumping tools.
+
+
+*Possible investigation steps*
+
+
+- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should treat any activity triggered from this rule with high priority as it typically represents an active adversary.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Determine if credential dumping tools were run on the host, and retrieve and analyze suspicious executables:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences on other hosts.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team, as these modifications expose the entire domain to credential compromises and consequently unauthorized access.
+
+
+*Related rules*
+
+
+- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+    registry.value : "UseLogonCredential" and
+    registry.path : "*\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential" and
+    registry.data.strings : ("1", "0x00000001") and
+    not (process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
new file mode 100644
index 0000000000..0162352920
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
@@ -0,0 +1,119 @@
+[[prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal]]
+=== Multiple Microsoft Entra ID Protection Alerts by User Principal
+
+Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-azure.identity_protection-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-azure-monitor-sign-ins-log-schema
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk
+* https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#investigation-framework
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Entra ID
+* Data Source: Microsoft Entra ID Protection Logs
+* Use Case: Identity and Access Audit
+* Resources: Investigation Guide
+* Tactic: Initial Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Multiple Microsoft Entra ID Protection Alerts by User Principal*
+
+
+
+*Possible investigation steps*
+
+- Identify the Risk Detection that triggered the event. A list with descriptions can be found https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#risk-types-and-detection[here].
+- Identify the user account involved and validate whether the suspicious activity is normal for that user.
+  - Consider the source IP address and geolocation for the involved user account. Do they look normal?
+  - Consider the device used to sign in. Is it registered and compliant?
+- Investigate other alerts associated with the user account during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if this operation was approved and performed according to the organization's change management policy.
+- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.
+
+
+*False positive analysis*
+
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and device conditions.
+- Consider the context of the user account and whether the activity is expected. For example, if the user is a developer or administrator, they may have legitimate reasons for accessing resources from various locations or devices.
+
+
+*Response and remediation*
+
+- Initiate the incident response process based on the outcome of the triage.
+- Disable or limit the account during the investigation and response.
+- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:
+    - Identify the account role in the cloud environment.
+    - Assess the criticality of affected services and servers.
+    - Work with your IT team to identify and minimize the impact on users.
+    - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.
+    - Identify any regulatory or legal ramifications related to this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.
+- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.
+- Consider enabling multi-factor authentication for users.
+- Follow security best practices https://docs.microsoft.com/en-us/azure/security/fundamentals/identity-management-best-practices[outlined] by Microsoft.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by azure.identityprotection.properties.user_principal_name with maxspan=10m
+[any where event.module == "azure" and event.dataset == "azure.identity_protection"] with runs=2
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Cloud Accounts
+** ID: T1078.004
+** Reference URL: https://attack.mitre.org/techniques/T1078/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
new file mode 100644
index 0000000000..e4235dfa11
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
@@ -0,0 +1,140 @@
+[[prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy]]
+=== Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy
+
+Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://developer.okta.com/docs/reference/api/system-log/
+* https://developer.okta.com/docs/reference/api/event-types/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Data Source: Okta
+* Tactic: Credential Access
+* Resources: Investigation Guide
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy*
+
+
+This rule detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. This may indicate that a shared device between users, or that a user is using a proxy to access multiple accounts for password spraying.
+
+
+*Possible investigation steps:*
+
+- Identify the users involved in this action by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.
+- Determine the device client used for these actions by analyzing `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+    - Since the device is behind a proxy, the `okta.client.ip` field will not be useful for determining the actual device IP address.
+- Review the `okta.request.ip_chain` field for more information about the geographic location of the proxy.
+- With Okta end users identified, review the `okta.debug_context.debug_data.dt_hash` field.
+    - Historical analysis should indicate if this device token hash is commonly associated with the user.
+- Review the `okta.event_type` field to determine the type of authentication event that occurred.
+    - If the event type is `user.authentication.sso`, the user may have legitimately started a session via a proxy for security or privacy reasons.
+    - If the event type is `user.authentication.password`, the user may be using a proxy to access multiple accounts for password spraying.
+- Examine the `okta.outcome.result` field to determine if the authentication was successful.
+- Review the past activities of the actor(s) involved in this action by checking their previous actions.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+    - This may help determine the authentication and authorization actions that occurred between the user, Okta and application.
+
+
+*False positive analysis:*
+
+- A user may have legitimately started a session via a proxy for security or privacy reasons.
+- Users may share an endpoint related to work or personal use in which separate Okta accounts are used.
+    - Architecturally, this shared endpoint may leverage a proxy for security or privacy reasons.
+    - Shared systems such as Kiosks and conference room computers may be used by multiple users.
+    - Shared working spaces may have a single endpoint that is used by multiple users.
+
+
+*Response and remediation:*
+
+- Review the profile of the users involved in this action to determine if proxy usage may be expected.
+- If the user is legitimate and the authentication behavior is not suspicious based on device analysis, no action is required.
+- If the user is legitimate but the authentication behavior is suspicious, consider resetting passwords for the users involves and enabling multi-factor authentication (MFA).
+    - If MFA is already enabled, consider resetting MFA for the users.
+- If any of the users are not legitimate, consider deactivating the user's account.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- Check with internal IT teams to determine if the accounts involved recently had MFA reset at the request of the user.
+    - If so, confirm with the user this was a legitimate request.
+    - If so and this was not a legitimate request, consider deactivating the user's account temporarily.
+        - Reset passwords and reset MFA for the user.
+- If this is a false positive, consider adding the `okta.debug_context.debug_data.dt_hash` field to the `exceptions` list in the rule.
+    - This will prevent future occurrences of this event for this device from triggering the rule.
+
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system
+    and not okta.actor.id:okta* and okta.debug_context.debug_data.dt_hash:*
+    and okta.event_type:user.authentication* and okta.security_context.is_proxy:true
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Credential Stuffing
+** ID: T1110.004
+** Reference URL: https://attack.mitre.org/techniques/T1110/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain.asciidoc
new file mode 100644
index 0000000000..5b71fe97b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain]]
+=== Network Activity to a Suspicious Top Level Domain
+
+Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executable running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.network-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.cybercrimeinfocenter.org/top-20-tlds-by-malicious-phishing-domains
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Data Source: Sysmon
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Network Activity to a Suspicious Top Level Domain*
+
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes or malicious scripts.
+- Review if the domain reputation and the frequency of network activities as well as any download/upload activity.
+- Verify if the executed process is persistent on the host like common mechanisms Startup folder, task or Run key.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
+
+
+*False positive analysis*
+
+
+- Trusted domain from an expected process running in the environment.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Immediately block the identified indicators of compromise (IoCs).
+- Implement any temporary network rules, procedures, and segmentation required to contain the attack.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Update firewall rules to be more restrictive.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and dns.question.name != null and
+ (
+  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
+                  "bitsadmin.exe", "InstallUtil.exe", "python.exe", "regsvr32.exe", "dllhost.exe", "node.exe",
+                  "java.exe", "javaw.exe", "*.pif", "*.com", "*.scr") or
+  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
+  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
+  process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
+ ) and
+dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)"""
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: DNS
+** ID: T1071.004
+** Reference URL: https://attack.mitre.org/techniques/T1071/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp.asciidoc
new file mode 100644
index 0000000000..fdf310ba7a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp]]
+=== Okta Sign-In Events via Third-Party IdP
+
+Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* logs-okta*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 15m
+
+*Searches indices from*: now-30m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://unit42.paloaltonetworks.com/muddled-libra/
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Use Case: Identity and Access Audit
+* Tactic: Initial Access
+* Data Source: Okta
+* Resources: Investigation Guide
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Okta Sign-In Events via Third-Party IdP*
+
+
+This rule detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP).
+
+Adversaries may attempt to add an unauthorized IdP to an Okta tenant to gain access to the tenant. Following this action, adversaries may attempt to sign in to the tenant using the unauthorized IdP. This rule detects both the addition of an unauthorized IdP and the subsequent sign-in attempt.
+
+
+*Possible investigation steps:*
+
+- Identify the third-party IdP by examining the `okta.authentication_context.issuer.id` field.
+- Once the third-party IdP is identified, determine if this IdP is authorized to be used by the tenant.
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Identify the actor associated with the IdP creation by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields in historical data.
+    - The `New Okta Identity Provider (IdP) Added by Admin` rule may be helpful in identifying the actor and the IdP creation event.
+- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.
+- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.
+- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.
+- Examine the `okta.request.ip_chain` field to potentially determine if the actor used a proxy or VPN to perform this action.
+- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.
+
+
+*False positive analysis:*
+
+- It might be a false positive if this IdP is authorized to be used by the tenant.
+- This may be a false positive if an authorized third-party IdP is used to sign in to the tenant but failures occurred due to an incorrect configuration.
+
+
+*Response and remediation:*
+
+- If the IdP is unauthorized, deactivate it immediately via the Okta console.
+- Reset the effected user's password and enforce MFA re-enrollment, if applicable.
+- Mobile device forensics may be required to determine if the user's device is compromised.
+- If the IdP is authorized, ensure that the actor who created it is authorized to do so.
+- If the actor is unauthorized, deactivate their account via the Okta console.
+- If the actor is authorized, ensure that the actor's account is not compromised.
+
+- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.
+- Conduct a review of Okta policies and ensure they are in accordance with security best practices.
+- If the deactivated IdP was crucial to the organization, consider adding a new IdP and removing the unauthorized IdP.
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:okta.system and okta.debug_context.debug_data.request_uri:/oauth2/v1/authorize/callback and
+    (not okta.authentication_context.issuer.id:Okta and event.action:(user.authentication.auth_via_IDP
+        or user.authentication.auth_via_inbound_SAML
+        or user.authentication.auth_via_mfa
+        or user.authentication.auth_via_social)
+        or event.action:user.session.start) or
+    (event.action:user.authentication.auth_via_IDP and okta.outcome.result:FAILURE
+        and okta.outcome.reason:("A SAML assert with the same ID has already been processed by Okta for a previous request"
+            or "Unable to match transformed username"
+            or "Unable to resolve IdP endpoint"
+            or "Unable to validate SAML Response"
+            or "Unable to validate incoming SAML Assertion"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Trusted Relationship
+** ID: T1199
+** Reference URL: https://attack.mitre.org/techniques/T1199/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-outlook-home-page-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-outlook-home-page-registry-modification.asciidoc
new file mode 100644
index 0000000000..aaa0865c3e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-outlook-home-page-registry-modification.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-18-14-outlook-home-page-registry-modification]]
+=== Outlook Home Page Registry Modification
+
+Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://cloud.google.com/blog/topics/threat-intelligence/breaking-the-rules-tough-outlook-for-home-page-attacks/
+* https://github.com/trustedsec/specula
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+* Data Source: Crowdstrike
+
+*Version*: 207
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Outlook Home Page Registry Modification*
+
+
+The Outlook Home Page feature allows users to set a webpage as the default view for folders, leveraging registry keys to store URL configurations. Adversaries exploit this by modifying these keys to redirect to malicious sites, enabling command and control or persistence. The detection rule identifies suspicious registry changes, focusing on URL entries within specific paths, flagging potential misuse for further investigation.
+
+
+*Possible investigation steps*
+
+
+- Review the registry path and value to confirm the presence of a suspicious URL entry in the specified registry paths, such as "HKCU\\*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\Inbox\\URL".
+- Investigate the URL found in the registry data strings to determine if it is known to be malicious or associated with suspicious activity.
+- Check the modification history of the registry key to identify when the change occurred and which user or process made the modification.
+- Correlate the registry modification event with other security events on the host, such as network connections or process executions, to identify potential malicious activity.
+- Assess the affected system for signs of compromise, including unusual network traffic or unauthorized access attempts, to determine the scope of the incident.
+- Consult threat intelligence sources to see if the URL or related indicators are associated with known threat actors or campaigns.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may modify the registry keys associated with Outlook's Home Page feature. Users can create exceptions for known software update processes to prevent unnecessary alerts.
+- Custom scripts or administrative tools used by IT departments to configure Outlook settings across multiple machines might trigger this rule. Identifying and excluding these trusted scripts or tools can reduce false positives.
+- Some third-party Outlook add-ins or plugins may alter the registry keys for legitimate purposes. Users should verify the legitimacy of these add-ins and whitelist them if they are deemed safe.
+- Automated backup or recovery solutions that restore Outlook settings might cause registry changes. Users can exclude these processes if they are part of a regular and secure backup routine.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further communication with potentially malicious sites.
+- Use endpoint detection and response (EDR) tools to terminate any suspicious processes associated with the modified registry keys.
+- Restore the modified registry keys to their default values to remove the malicious URL configuration.
+- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any additional threats.
+- Review and analyze network logs to identify any outbound connections to suspicious domains or IP addresses, and block these at the firewall.
+- Escalate the incident to the security operations center (SOC) for further investigation and to determine if other systems are affected.
+- Implement additional monitoring on the affected system and similar endpoints to detect any recurrence of the threat, focusing on registry changes and network activity.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.action != "deletion" and registry.value : "URL" and
+    registry.path : (
+        "*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\*",
+        "*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Today\\*"
+    ) and registry.data.strings : ("*://*", "*:\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Office Application Startup
+** ID: T1137
+** Reference URL: https://attack.mitre.org/techniques/T1137/
+* Sub-technique:
+** Name: Outlook Home Page
+** ID: T1137.004
+** Reference URL: https://attack.mitre.org/techniques/T1137/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-dcsync.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-dcsync.asciidoc
new file mode 100644
index 0000000000..0376404228
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-dcsync.asciidoc
@@ -0,0 +1,168 @@
+[[prebuilt-rule-8-18-14-potential-credential-access-via-dcsync]]
+=== Potential Credential Access via DCSync
+
+This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-system.security*
+* logs-windows.forwarded*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html
+* https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing
+* https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml
+* https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md
+* https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync
+* https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Privilege Escalation
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+* Data Source: Windows Security Event Logs
+
+*Version*: 220
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via DCSync*
+
+
+Active Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.
+
+Active Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.
+
+Adversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.
+
+More details can be found on https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing[Threat Hunter Playbook] and https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync[The Hacker Recipes].
+
+This rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028[here]).
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.
+- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).
+
+
+*False positive analysis*
+
+
+- Administrators may use custom accounts on Azure AD Connect, investigate if it is the case, and if it is properly secured. If noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
+- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. If this rule is noisy in your environment due to expected activity, consider adding the corresponding account as a exception.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the entire domain or the `krbtgt` user was compromised:
+  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
+- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Access (Success,Failure)
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:"windows" and event.code:"4662" and
+  winlog.event_data.Properties:(
+    *DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or
+    *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or
+    *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*
+  ) and winlog.event_data.AccessMask : "0x100" and
+  not winlog.event_data.SubjectUserName:(*$ or MSOL_*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: DCSync
+** ID: T1003.006
+** Reference URL: https://attack.mitre.org/techniques/T1003/006/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Domain Accounts
+** ID: T1078.002
+** Reference URL: https://attack.mitre.org/techniques/T1078/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities.asciidoc
new file mode 100644
index 0000000000..5654339a06
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities.asciidoc
@@ -0,0 +1,175 @@
+[[prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities]]
+=== Potential Credential Access via Windows Utilities
+
+Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/
+* https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Sysmon
+
+*Version*: 319
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via Windows Utilities*
+
+
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
+
+The `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.
+
+This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to identify what information was targeted.
+- Identify the target computer and its role in the IT environment.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the host is a domain controller (DC):
+  - Activate your incident response plan for total Active Directory compromise.
+  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (?process.pe.original_file_name : "procdump" or process.name : "procdump.exe") and process.args : "-ma"
+  ) or
+  (
+    process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*"""
+  ) or
+  (
+    (?process.pe.original_file_name : "WriteMiniDump.exe" or process.name : "WriteMiniDump.exe") and
+      not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*"""
+  ) or
+  (
+    (?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
+      (process.args : "*MiniDump*" or process.command_line : "*comsvcs*#*24*")
+  ) or
+  (
+    (?process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
+      process.args : "/fullmemdmp"
+  ) or
+  (
+    (?process.pe.original_file_name : "SqlDumper.exe" or process.name : "SqlDumper.exe") and
+      process.args : "0x01100*") or
+  (
+    (?process.pe.original_file_name : "TTTracer.exe" or process.name : "TTTracer.exe") and
+      process.args : "-dumpFull" and process.args : "-attach") or
+  (
+    (?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
+      process.args : "cr*fu*") or
+  (
+    (?process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
new file mode 100644
index 0000000000..38ef9c2449
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
@@ -0,0 +1,166 @@
+[[prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs]]
+=== Potential DLL Side-Loading via Trusted Microsoft Programs
+
+Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-crowdstrike.fdr*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Resources: Investigation Guide
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential DLL Side-Loading via Trusted Microsoft Programs*
+
+
+DLL side-loading exploits the DLL search order to load malicious code into trusted Microsoft programs, which are often whitelisted by security tools. Adversaries rename or relocate these programs to execute unauthorized DLLs, evading detection. The detection rule identifies unusual execution paths or renamed instances of these programs, signaling potential misuse and enabling timely threat response.
+
+
+*Possible investigation steps*
+
+
+- Review the process details to confirm the original file name and the path from which the process was executed. Check if the process.pe.original_file_name matches any of the specified trusted programs like "WinWord.exe", "EXPLORER.EXE", "w3wp.exe", or "DISM.EXE".
+- Investigate the process execution path to determine if it deviates from the standard paths listed in the query, such as "?:\Windows\explorer.exe" or "?:\Program Files\Microsoft Office\root\Office*\WINWORD.EXE".
+- Examine the process creation history and parent process to identify any unusual or suspicious parent-child relationships that might indicate malicious activity.
+- Check for any recent file modifications or creations in the directory from which the process was executed, which could suggest the presence of a malicious DLL.
+- Correlate the event with other security logs or alerts from data sources like Elastic Endgame, Elastic Defend, Sysmon, or Microsoft Defender for Endpoint to gather additional context and identify potential patterns of malicious behavior.
+- Assess the risk and impact of the event by considering the risk score and severity level provided, and determine if immediate containment or further investigation is necessary.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may temporarily execute trusted Microsoft programs from non-standard paths. Users can create exceptions for known update processes to prevent false alerts.
+- Custom enterprise applications might use renamed instances of trusted Microsoft programs for legitimate purposes. Identify and whitelist these specific applications to avoid unnecessary alerts.
+- Virtual environments or sandboxed applications may execute trusted programs from unusual paths as part of their normal operation. Review and exclude these environments if they are known and trusted.
+- Security or IT administrative tools might mimic trusted Microsoft programs for monitoring or management tasks. Verify these tools and add them to an exception list if they are part of standard operations.
+- Development or testing environments often involve renamed or relocated executables for debugging purposes. Ensure these environments are recognized and excluded from the detection rule to reduce false positives.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further spread of the potential threat and unauthorized access.
+- Terminate the suspicious process identified by the detection rule to stop any ongoing malicious activity.
+- Conduct a forensic analysis of the affected system to identify any malicious DLLs or additional compromised files, and remove them.
+- Restore the affected system from a known good backup to ensure all malicious changes are reverted.
+- Update and patch all software on the affected system, focusing on the trusted Microsoft programs identified in the alert, to mitigate vulnerabilities exploited by DLL side-loading.
+- Monitor the network for any signs of lateral movement or additional compromised systems, using the indicators of compromise identified during the investigation.
+- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems or data have been affected.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") or
+    ?process.pe.original_file_name : ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE")
+  ) and
+  not process.executable : (
+          "\\\\?\\Volume{????????-????-????-????-????????????}\\Windows\\System32\\inetsrv\\w3wp.exe",
+          "?:\\PROGRA~?\\MICROS~?\\Office??\\winword.exe",
+          "?:\\Program Files\\Microsoft Office\\*\\winword.exe",
+          "?:\\Program Files\\Microsoft Office ??\\*\\winword.exe",
+          "?:\\Program Files\\WindowsApps\\Microsoft.Office.Desktop.*\\Office??\\winword.exe",
+          "?:\\Program Files (x86)\\Microsoft Office\\*\\winword.exe",
+          "?:\\Program Files (x86)\\Windows Kits\\*Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
+          "?:\\Windows\\explorer.exe",
+          "?:\\Windows\\System32\\Dism.exe",
+          "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+          "?:\\Windows\\SysWOW64\\Dism.exe",
+          "?:\\Windows\\SysWOW64\\explorer.exe",
+          "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe"
+  ) and
+  /* Crowdstrike specific exclusion as it uses NT Object paths */
+  not
+  (
+    data_stream.dataset == "crowdstrike.fdr" and
+    process.executable : (
+        "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Office\\*\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Office ??\\*\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\Microsoft.Office.Desktop.*\\Office??\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\Microsoft Office\\*\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\Dism.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\inetsrv\\w3wp.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\Dism.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\explorer.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\inetsrv\\w3wp.exe"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser.asciidoc
new file mode 100644
index 0000000000..a620073ebd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser.asciidoc
@@ -0,0 +1,122 @@
+[[prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser]]
+=== Potential File Download via a Headless Browser
+
+Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries may use browsers to avoid ingress tool transfer restrictions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/lolbas/Binaries/Msedge/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Windows
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Sysmon
+* Data Source: Crowdstrike
+
+*Version*: 207
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential File Download via a Headless Browser*
+
+
+- Investigate the process execution chain (parent process tree).
+- Investigate the process network and file events.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe", "vivaldi.exe") and
+  process.args : "--headless*" and
+  process.args : ("--disable-gpu", "--dump-dom", "*http*", "data:text/html;base64,*") and
+  process.parent.name :
+     ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "conhost.exe", "msiexec.exe",
+      "explorer.exe", "rundll32.exe", "winword.exe", "excel.exe", "onenote.exe", "hh.exe", "powerpnt.exe", "forfiles.exe",
+      "pcalua.exe", "wmiprvse.exe") and
+  not process.executable : (
+        "?:\\inetpub\\wwwroot\\*\\ext\\modules\\html2pdf\\bin\\chrome\\*\\chrome-win64\\chrome.exe",
+        "\\Device\\HarddiskVolume*\\inetpub\\wwwroot\\*\\ext\\modules\\html2pdf\\bin\\chrome\\*\\chrome-win64\\chrome.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt.asciidoc
new file mode 100644
index 0000000000..d632a7fcbd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt.asciidoc
@@ -0,0 +1,198 @@
+[[prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt]]
+=== Potential Malware-Driven SSH Brute Force Attempt
+
+This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Impact
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Malware-Driven SSH Brute Force Attempt*
+
+
+SSH is a protocol used to securely access remote systems. Adversaries exploit it by deploying malware on compromised Linux hosts to perform brute-force attacks, attempting unauthorized access to other systems. The detection rule identifies such abuse by monitoring high volumes of outbound SSH connection attempts from a single process to external IPs, indicating potential malware activity.
+
+
+*Possible investigation steps*
+
+
+- Review the process executable identified in the alert to determine if it is a legitimate application or potentially malicious. Check for known malware signatures or unusual file paths.
+- Analyze the destination IP addresses involved in the connection attempts to identify if they are known malicious hosts or part of a larger attack infrastructure. Use threat intelligence sources to gather more information.
+- Examine the host's recent activity logs to identify any unusual behavior or signs of compromise, such as unexpected process executions or changes in system configurations.
+- Investigate the specific agent.id associated with the alert to determine if other alerts or suspicious activities have been reported from the same host, indicating a broader compromise.
+- Check for any recent changes or updates to the host's software or configurations that could have introduced vulnerabilities exploited by the malware.
+- Assess the network traffic patterns from the host to identify any other unusual outbound connections that may indicate additional malicious activity or data exfiltration attempts.
+
+
+*False positive analysis*
+
+
+- High-volume legitimate SSH operations from a single process can trigger alerts. Exclude known safe processes or scripts that perform frequent SSH operations by adding them to an exception list.
+- Automated backup or synchronization tools using SSH to connect to external servers may be misidentified. Identify these tools and exclude their process names or IP addresses from the detection rule.
+- Development or testing environments where SSH connections are frequently initiated to external systems for legitimate purposes can cause false positives. Document these environments and adjust the rule to exclude their specific IP ranges or process identifiers.
+- Security scanning tools that perform SSH checks on external systems might be flagged. Ensure these tools are recognized and their activities are excluded by specifying their process names or IP addresses in the rule exceptions.
+
+
+*Response and remediation*
+
+
+- Isolate the affected Linux host from the network immediately to prevent further unauthorized access attempts and potential spread of malware to other systems.
+- Terminate the suspicious process identified by the detection rule to stop ongoing brute-force attempts and reduce the risk of further compromise.
+- Conduct a thorough malware scan on the isolated host using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any malicious software.
+- Review and reset credentials for any accounts that may have been targeted or compromised during the brute-force attempts to ensure account security.
+- Apply security patches and updates to the affected host and any other vulnerable systems to mitigate known vulnerabilities that could be exploited by similar threats.
+- Monitor network traffic for any signs of continued or new suspicious activity, particularly focusing on outbound SSH connections, to detect and respond to any further attempts promptly.
+- Escalate the incident to the security operations center (SOC) or relevant security team for further investigation and to assess the potential impact on the broader network infrastructure.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.network-*
+| keep @timestamp, host.os.type, event.type, event.action, destination.port, process.executable, destination.ip, agent.id, host.name
+| where
+    @timestamp > now() - 1 hours and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "connection_attempted" and
+    destination.port in (22, 222, 2222, 10022, 2022, 2200, 62612, 8022) and
+    not (
+      cidr_match(
+        destination.ip,
+        "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
+        "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
+        "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24",
+        "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
+        "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
+        "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
+      ) or
+      process.executable in (
+        "/usr/bin/rclone", "/usr/bin/sss_ssh_knownhostsproxy", "/usr/sbin/sshd", "/usr/bin/ssh",
+        "/usr/local/bin/php", "/usr/sbin/apache2", "/usr/sbin/nginx", "/usr/local/bin/argocd-repo-server"
+      ) or
+      process.executable like "/usr/local/efax/*"
+    )
+| stats
+    Esql.event_count = count(),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+  by process.executable, destination.port
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.event_count > 15
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries.asciidoc
new file mode 100644
index 0000000000..350c6b2e89
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries.asciidoc
@@ -0,0 +1,180 @@
+[[prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries]]
+=== Potential Modification of Accessibility Binaries
+
+Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/blog/practical-security-engineering-stateful-detection
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Modification of Accessibility Binaries*
+
+
+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
+
+More details can be found https://attack.mitre.org/techniques/T1546/008/[here].
+
+This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : ("Utilman.exe", "winlogon.exe") and user.name == "SYSTEM" and
+ process.pe.original_file_name : "?*" and
+ process.args :
+    (
+    "C:\\Windows\\System32\\osk.exe",
+    "C:\\Windows\\System32\\Magnify.exe",
+    "C:\\Windows\\System32\\Narrator.exe",
+    "C:\\Windows\\System32\\Sethc.exe",
+    "utilman.exe",
+    "ATBroker.exe",
+    "DisplaySwitch.exe",
+    "sethc.exe"
+    )
+ and not process.pe.original_file_name in
+    (
+    "osk.exe",
+    "sethc.exe",
+    "utilman2.exe",
+    "DisplaySwitch.exe",
+    "atbroker.exe",
+    "ATBroker.exe",
+    "ScreenMagnifier.exe",
+    "SR.exe",
+    "Narrator.exe",
+    "magnify.exe",
+    "MAGNIFY.EXE"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..7aa7ad1c13
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications]]
+=== Potential Okta MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta.system*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Domain: Identity
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+* Data Source: Okta System Logs
+* Resources: Investigation Guide
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Okta MFA Bombing via Push Notifications*
+
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+
+*Possible investigation steps:*
+
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+
+*False positive analysis:*
+
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+
+*Response and remediation:*
+
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [ any
+    where event.dataset == "okta.system"
+      and (
+        okta.event_type == "user.mfa.okta_verify.deny_push"
+        or (
+          okta.event_type == "user.authentication.auth_via_mfa"
+          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
+          and okta.outcome.reason == "INVALID_CREDENTIALS"
+        )
+      )
+  ] with runs=5
+  until
+  [ any
+    where event.dataset == "okta.system"
+      and okta.event_type in (
+        "user.authentication.sso",
+        "user.authentication.auth_via_mfa",
+        "user.authentication.verify",
+        "user.session.start"
+      )
+      and okta.outcome.result == "SUCCESS"
+  ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host.asciidoc
new file mode 100644
index 0000000000..4b108bf9c4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host.asciidoc
@@ -0,0 +1,184 @@
+[[prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host]]
+=== Potential Port Scanning Activity from Compromised Host
+
+This rule detects potential port scanning activity from a compromised host. Port scanning is a common reconnaissance technique used by attackers to identify open ports and services on a target system. A compromised host may exhibit port scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable services, or prepare for further exploitation. This rule identifies potential port scanning activity by monitoring network connection attempts from a single host to a large number of ports within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Port Scanning Activity from Compromised Host*
+
+
+Port scanning is a reconnaissance method used by attackers to identify open ports and services on a network, often as a precursor to exploitation. In Linux environments, compromised hosts may perform rapid connection attempts to numerous ports, signaling potential scanning activity. The detection rule identifies such behavior by analyzing network logs for a high number of distinct port connections from a single host within a short timeframe, indicating possible malicious intent.
+
+
+*Possible investigation steps*
+
+
+- Review the network logs to identify the specific host exhibiting the port scanning behavior by examining the destination.ip and process.executable fields.
+- Analyze the @timestamp field to determine the exact time frame of the scanning activity and correlate it with any other suspicious activities or alerts from the same host.
+- Investigate the process.executable field to understand which application or service initiated the connection attempts, and verify if it is a legitimate process or potentially malicious.
+- Check the destination.port field to identify the range and types of ports targeted by the scanning activity, which may provide insights into the attacker's objectives or the services they are interested in.
+- Assess the host's security posture by reviewing recent changes, installed software, and user activity to determine if the host has been compromised or if the scanning is part of legitimate network operations.
+- Consult the original documents and logs for additional context and details that may not be captured in the alert to aid in a comprehensive investigation.
+
+
+*False positive analysis*
+
+
+- Legitimate network scanning tools used by system administrators for network maintenance or security assessments can trigger this rule. To handle this, identify and whitelist the IP addresses or processes associated with these tools.
+- Automated vulnerability scanners or monitoring systems that perform regular checks on network services may cause false positives. Exclude these systems by creating exceptions for their known IP addresses or process names.
+- High-volume legitimate services that open multiple connections to different ports, such as load balancers or proxy servers, might be flagged. Review and exclude these services by specifying their IP addresses or process executables.
+- Development or testing environments where frequent port scanning is part of routine operations can be mistakenly identified. Implement exceptions for these environments by excluding their specific network segments or host identifiers.
+- Scheduled network discovery tasks that are part of IT operations can mimic port scanning behavior. Document and exclude these tasks by setting up time-based exceptions or identifying their unique process signatures.
+
+
+*Response and remediation*
+
+
+- Isolate the compromised host from the network immediately to prevent further scanning and potential lateral movement.
+- Terminate any suspicious processes identified by the process.executable field to halt ongoing malicious activities.
+- Conduct a thorough review of the compromised host's system logs and network traffic to identify any unauthorized access or data exfiltration attempts.
+- Patch and update all software and services on the compromised host to close any vulnerabilities that may have been exploited.
+- Change all credentials associated with the compromised host and any potentially affected systems to prevent unauthorized access.
+- Monitor the network for any further signs of scanning activity or other suspicious behavior from other hosts, indicating potential additional compromises.
+- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.network-*
+| where
+    @timestamp > now() - 1h and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "connection_attempted" and
+    not (
+      cidr_match(destination.ip, "127.0.0.0/8", "::1", "FE80::/10", "FF00::/8") or
+      process.executable in (
+        "/opt/dbtk/bin/jsvc", "/usr/lib/dotnet/dotnet", "/usr/share/elasticsearch/jdk/bin/java", "/usr/sbin/haproxy",
+        "/usr/bin/java", "/opt/kaspersky/kesl/libexec/kesl", "/usr/bin/dotnet", "/opt/java/openjdk/bin/java"
+      ) or
+      process.executable like "/var/opt/kaspersky/kesl/*kesl" or
+      process.executable like "/usr/lib/jvm/*/java" or
+      process.executable like "/opt/google/chrome*" or
+      process.executable like "/var/lib/docker/*/java" or
+      process.executable like "/usr/lib64/jvm/*/java" or
+      process.executable like "/snap/*" or
+      process.executable like "/home/*/.local/share/JetBrains/*"
+    )
+| keep
+    @timestamp,
+    host.os.type,
+    event.type,
+    event.action,
+    destination.port,
+    process.executable,
+    destination.ip,
+    agent.id,
+    host.name
+| stats
+    Esql.event_count = count(),
+    Esql.destination_port_count_distinct = count_distinct(destination.port),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+    by process.executable, destination.ip
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.destination_port_count_distinct > 100
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author.asciidoc
new file mode 100644
index 0000000000..08b5daddbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author.asciidoc
@@ -0,0 +1,165 @@
+[[prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author]]
+=== Potential PowerShell HackTool Script by Author
+
+Detects known PowerShell offensive tooling author's name in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code, which may still contain the author artifacts. This rule identifies common author handles found in popular PowerShell scripts used for red team exercises.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential PowerShell HackTool Script by Author*
+
+
+PowerShell is a powerful scripting language and automation framework used in Windows environments for task automation and configuration management. Adversaries exploit PowerShell's capabilities to execute malicious scripts, often leveraging well-known offensive tools without altering the original code. The detection rule identifies scripts containing specific author names linked to these tools, flagging potential misuse by recognizing unmodified author artifacts in the script block text.
+
+
+*Possible investigation steps*
+
+
+- Review the PowerShell script block text associated with the alert to identify the specific author name that triggered the detection. This can provide insight into the potential tool or script being used.
+- Examine the process details, including the parent process and command line arguments, to understand the context in which the PowerShell script was executed. This can help determine if the execution was part of a legitimate task or a suspicious activity.
+- Check the host's recent activity logs for any other unusual or related events, such as network connections, file modifications, or other process executions, to identify potential lateral movement or data exfiltration attempts.
+- Investigate the user account under which the PowerShell script was executed to determine if it has been compromised or if the activity aligns with the user's typical behavior.
+- Correlate the alert with other security tools and logs, such as antivirus or endpoint detection and response (EDR) solutions, to gather additional context and confirm whether the activity is malicious.
+
+
+*False positive analysis*
+
+
+- Scripts used in legitimate red team exercises may trigger the rule due to the presence of known author names. To manage this, create exceptions for scripts verified as part of authorized security assessments.
+- PowerShell scripts from open-source security tools used for internal testing or training might be flagged. Ensure these tools are documented and approved, then exclude them from the rule.
+- Automated scripts for system administration that include code snippets from well-known authors could be mistakenly identified. Review and whitelist these scripts if they are part of routine operations.
+- Security research and development activities using sample scripts from recognized authors may cause alerts. Maintain a list of such activities and exclude them from detection to avoid unnecessary alerts.
+- Internal development teams using PowerShell scripts for legitimate purposes might inadvertently use code from popular authors. Conduct regular reviews and exclude these scripts if they are deemed non-threatening.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further execution of potentially malicious scripts and lateral movement.
+- Terminate any suspicious PowerShell processes identified by the alert to halt ongoing malicious activity.
+- Conduct a thorough review of the PowerShell script block text to confirm the presence of known offensive tool author names and assess the potential impact.
+- Remove any unauthorized or malicious scripts from the affected system and ensure that all legitimate scripts are verified and restored from a clean backup.
+- Update endpoint protection and antivirus signatures to detect and block the specific PowerShell scripts and associated indicators of compromise (IOCs) identified in the alert.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for PowerShell activity across the network to detect similar threats in the future, leveraging the MITRE ATT&CK framework for guidance on relevant techniques and tactics.
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and
+  powershell.file.script_block_text : (
+      "mattifestation" or "JosephBialek" or
+      "harmj0y" or "ukstufus" or
+      "SecureThisShit" or "Matthew Graeber" or
+      "secabstraction" or "mgeeky" or
+      "oddvarmoe" or "am0nsec" or
+      "obscuresec" or "sixdub" or
+      "darkoperator" or "funoverip" or
+      "rvrsh3ll" or "kevin_robertson" or
+      "dafthack" or "r4wd3r" or
+      "danielhbohannon" or "OneLogicalMyth" or
+      "cobbr_io" or "xorrior" or
+      "PetrMedonos" or "citronneur" or
+      "eladshamir" or "RastaMouse" or
+      "enigma0x3" or "FuzzySec" or
+      "424f424f" or "jaredhaight" or
+      "fullmetalcache" or "Hubbl3" or
+      "curi0usJack" or "Cx01N" or
+      "itm4n" or "nurfed1" or
+      "cfalta" or "Scott Sutherland" or
+      "_nullbind" or "_tmenochet" or
+      "jaredcatkinson" or "ChrisTruncer" or
+      "monoxgas" or "TheRealWover" or
+      "splinter_code"
+  ) and
+  not powershell.file.script_block_text : ("Get-UEFIDatabaseSigner" or "Posh-SSH")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names.asciidoc
new file mode 100644
index 0000000000..7b1dc7c9ca
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -0,0 +1,356 @@
+[[prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names]]
+=== Potential PowerShell HackTool Script by Function Names
+
+Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+* https://github.com/BC-SECURITY/Empire
+* https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 218
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential PowerShell HackTool Script by Function Names*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Adversaries often exploit PowerShell's capabilities to execute malicious scripts and perform various attacks. This rule identifies known offensive tooling function names in PowerShell scripts, as attackers commonly use out-of-the-box tools without modifying the code. By monitoring these specific function names, the rule aims to detect and alert potential malicious PowerShell activity.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script's execution context, such as the user account, privileges, the role of the system on which it was executed, and any relevant timestamps.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate the origin of the PowerShell script, including its source, download method, and any associated URLs or IP addresses.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This rule may generate false positives if legitimate scripts or tools used by administrators contain any of the listed function names. These function names are commonly associated with offensive tooling, but they may also be present in benign scripts or tools.
+- To handle these false positives consider adding exceptions - preferably with a combination of full file path and users.
+
+
+*Related Rules*
+
+
+- PowerShell Invoke-NinjaCopy script - b8386923-b02c-4b94-986a-d223d9b01f88
+- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Add-DomainGroupMember" or "Add-DomainObjectAcl" or
+    "Add-RemoteConnection" or "Add-ServiceDacl" or
+    "Add-Win32Type" or "Convert-ADName" or
+    "Convert-LDAPProperty" or "ConvertFrom-LDAPLogonHours" or
+    "ConvertFrom-UACValue" or "Copy-ArrayOfMemAddresses" or
+    "Create-NamedPipe" or "Create-ProcessWithToken" or
+    "Create-RemoteThread" or "Create-SuspendedWinLogon" or
+    "Create-WinLogonProcess" or "Emit-CallThreadStub" or
+    "Enable-SeAssignPrimaryTokenPrivilege" or "Enable-SeDebugPrivilege" or
+    "Enum-AllTokens" or "Export-PowerViewCSV" or
+    "Find-AVSignature" or "Find-AppLockerLog" or
+    "Find-DomainLocalGroupMember" or "Find-DomainObjectPropertyOutlier" or
+    "Find-DomainProcess" or "Find-DomainShare" or
+    "Find-DomainUserEvent" or "Find-DomainUserLocation" or
+    "Find-InterestingDomainAcl" or "Find-InterestingDomainShareFile" or
+    "Find-InterestingFile" or "Find-LocalAdminAccess" or
+    "Find-PSScriptsInPSAppLog" or "Find-PathDLLHijack" or
+    "Find-ProcessDLLHijack" or "Find-RDPClientConnection" or
+    "Get-AllAttributesForClass" or "Get-CachedGPPPassword" or
+    "Get-DecryptedCpassword" or "Get-DecryptedSitelistPassword" or
+    "Get-DelegateType" or "New-RelayEnumObject" or
+    "Get-DomainDFSShare" or "Get-DomainDFSShareV1" or
+    "Get-DomainDFSShareV2" or "Get-DomainDNSRecord" or
+    "Get-DomainDNSZone" or "Get-DomainFileServer" or
+    "Get-DomainForeignGroupMember" or "Get-DomainForeignUser" or
+    "Get-DomainGPO" or "Get-DomainGPOComputerLocalGroupMapping" or
+    "Get-DomainGPOLocalGroup" or "Get-DomainGPOUserLocalGroupMapping" or
+    "Get-DomainGUIDMap" or "Get-DomainGroup" or
+    "Get-DomainGroupMember" or "Get-DomainGroupMemberDeleted" or
+    "Get-DomainManagedSecurityGroup" or "Get-DomainOU" or
+    "Get-DomainObject" or "Get-DomainObjectAcl" or
+    "Get-DomainObjectAttributeHistory" or "Get-DomainObjectLinkedAttributeHistory" or
+    "Get-DomainPolicyData" or "Get-DomainSID" or
+    "Get-DomainSPNTicket" or "Get-DomainSearcher" or
+    "Get-DomainSite" or "Get-DomainSubnet" or
+    "Get-DomainTrust" or "Get-DomainTrustMapping" or
+    "Get-DomainUser" or "Get-DomainUserEvent" or
+    "Get-Forest" or "Get-ForestDomain" or
+    "Get-ForestGlobalCatalog" or "Get-ForestSchemaClass" or
+    "Get-ForestTrust" or "Get-GPODelegation" or
+    "Get-GPPAutologon" or "Get-GPPInnerField" or
+    "Get-GPPInnerFields" or "Get-GPPPassword" or
+    "Get-GptTmpl" or "Get-GroupsXML" or
+    "Get-HttpStatus" or "Get-ImageNtHeaders" or
+    "Get-Keystrokes" or "New-SOASerialNumberArray" or
+    "Get-MemoryProcAddress" or "Get-MicrophoneAudio" or
+    "Get-ModifiablePath" or "Get-ModifiableRegistryAutoRun" or
+    "Get-ModifiableScheduledTaskFile" or "Get-ModifiableService" or
+    "Get-ModifiableServiceFile" or "Get-Name" or
+    "Get-NetComputerSiteName" or "Get-NetLocalGroup" or
+    "Get-NetLocalGroupMember" or "Get-NetLoggedon" or
+    "Get-NetRDPSession" or "Get-NetSession" or
+    "Get-NetShare" or "Get-PEArchitecture" or
+    "Get-PEBasicInfo" or "Get-PEDetailedInfo" or
+    "Get-PathAcl" or "Get-PrimaryToken" or
+    "Get-ProcAddress" or "Get-ProcessTokenGroup" or
+    "Get-ProcessTokenPrivilege" or "Get-ProcessTokenType" or
+    "Get-RegLoggedOn" or "Get-RegistryAlwaysInstallElevated" or
+    "Get-RegistryAutoLogon" or "Get-RemoteProcAddress" or
+    "Get-Screenshot" or "Get-ServiceDetail" or
+    "Get-SiteListPassword" or "Get-SitelistField" or
+    "Get-System" or "Get-SystemNamedPipe" or
+    "Get-SystemToken" or "Get-ThreadToken" or
+    "Get-TimedScreenshot" or "Get-TokenInformation" or
+    "Get-TopPort" or "Get-UnattendedInstallFile" or
+    "Get-UniqueTokens" or "Get-UnquotedService" or
+    "Get-VaultCredential" or "Get-VaultElementValue" or
+    "Get-VirtualProtectValue" or "Get-VolumeShadowCopy" or
+    "Get-WMIProcess" or "Get-WMIRegCachedRDPConnection" or
+    "Get-WMIRegLastLoggedOn" or "Get-WMIRegMountedDrive" or
+    "Get-WMIRegProxy" or "Get-WebConfig" or
+    "Get-Win32Constants" or "Get-Win32Functions" or
+    "Get-Win32Types" or "Import-DllImports" or
+    "Import-DllInRemoteProcess" or "Inject-LocalShellcode" or
+    "Inject-RemoteShellcode" or "Install-ServiceBinary" or
+    "Invoke-CompareAttributesForClass" or "Invoke-CreateRemoteThread" or
+    "Invoke-CredentialInjection" or "Invoke-DllInjection" or
+    "Invoke-EventVwrBypass" or "Invoke-ImpersonateUser" or
+    "Invoke-Kerberoast" or "Invoke-MemoryFreeLibrary" or
+    "Invoke-MemoryLoadLibrary" or
+    "Invoke-Mimikatz" or "Invoke-NinjaCopy" or
+    "Invoke-PatchDll" or "Invoke-Portscan" or
+    "Invoke-PrivescAudit" or "Invoke-ReflectivePEInjection" or
+    "Invoke-ReverseDnsLookup" or "Invoke-RevertToSelf" or
+    "Invoke-ServiceAbuse" or "Invoke-Shellcode" or
+    "Invoke-TokenManipulation" or "Invoke-UserImpersonation" or
+    "Invoke-WmiCommand" or "Mount-VolumeShadowCopy" or
+    "New-ADObjectAccessControlEntry" or "New-DomainGroup" or
+    "New-DomainUser" or "New-DynamicParameter" or
+    "New-InMemoryModule" or
+    "New-ThreadedFunction" or "New-VolumeShadowCopy" or
+    "Out-CompressedDll" or "Out-EncodedCommand" or
+    "Out-EncryptedScript" or "Out-Minidump" or
+    "PortScan-Alive" or "Portscan-Port" or
+    "Remove-DomainGroupMember" or "Remove-DomainObjectAcl" or
+    "Remove-RemoteConnection" or "Remove-VolumeShadowCopy" or
+    "Restore-ServiceBinary" or "Set-DesktopACLToAllowEveryone" or
+    "Set-DesktopACLs" or "Set-DomainObject" or
+    "Set-DomainObjectOwner" or "Set-DomainUserPassword" or
+    "Set-ServiceBinaryPath" or "Sub-SignedIntAsUnsigned" or
+    "Test-AdminAccess" or "Test-MemoryRangeValid" or
+    "Test-ServiceDaclPermission" or "Update-ExeFunctions" or
+    "Update-MemoryAddresses" or "Update-MemoryProtectionFlags" or
+    "Write-BytesToMemory" or "Write-HijackDll" or
+    "Write-PortscanOut" or "Write-ServiceBinary" or
+    "Write-UserAddMSI" or "Invoke-Privesc" or
+    "func_get_proc_address" or "Invoke-BloodHound" or
+    "Invoke-HostEnum" or "Get-BrowserInformation" or
+    "Get-DomainAccountPolicy" or "Get-DomainAdmins" or
+    "Get-AVProcesses" or "Get-AVInfo" or
+    "Get-RecycleBin" or "Invoke-BruteForce" or
+    "Get-PassHints" or "Invoke-SessionGopher" or
+    "Get-LSASecret" or "Get-PassHashes" or
+    "Invoke-WdigestDowngrade" or "Get-ChromeDump" or
+    "Invoke-DomainPasswordSpray" or "Get-FoxDump" or
+    "New-HoneyHash" or "Invoke-DCSync" or
+    "Invoke-PowerDump" or "Invoke-SSIDExfil" or
+    "Invoke-PowerShellTCP" or "Add-Exfiltration" or
+    "Do-Exfiltration" or "Invoke-DropboxUpload" or
+    "Invoke-ExfilDataToGitHub" or "Invoke-EgressCheck" or
+    "Invoke-PostExfil" or "Create-MultipleSessions" or
+    "Invoke-NetworkRelay" or "New-GPOImmediateTask" or
+    "Invoke-WMIDebugger" or "Invoke-SQLOSCMD" or
+    "Invoke-SMBExec" or "Invoke-PSRemoting" or
+    "Invoke-ExecuteMSBuild" or "Invoke-DCOM" or
+    "Invoke-InveighRelay" or "Invoke-PsExec" or
+    "Find-ActiveUsersWMI" or
+    "Get-SystemDrivesWMI" or "Get-ActiveNICSWMI" or
+    "Remove-Persistence" or "DNS_TXT_Pwnage" or
+    "Execute-OnTime" or "HTTP-Backdoor" or
+    "Add-ConstrainedDelegationBackdoor" or "Add-RegBackdoor" or
+    "Add-ScrnSaveBackdoor" or "Gupt-Backdoor" or
+    "Invoke-ADSBackdoor" or "Add-Persistence" or
+    "Invoke-ResolverBackdoor" or "Invoke-EventLogBackdoor" or
+    "Invoke-DeadUserBackdoor" or "Invoke-DisableMachineAcctChange" or
+    "Invoke-AccessBinary" or "Add-NetUser" or
+    "Invoke-Schtasks" or "Invoke-JSRatRegsvr" or
+    "Invoke-JSRatRundll" or "Invoke-PoshRatHttps" or
+    "Invoke-PsGcatAgent" or "Remove-PoshRat" or
+    "Install-SSP" or "Invoke-BackdoorLNK" or
+    "PowerBreach" or "InstallEXE-Persistence" or
+    "RemoveEXE-Persistence" or "Install-ServiceLevel-Persistence" or
+    "Remove-ServiceLevel-Persistence" or "Invoke-Prompt" or
+    "Invoke-PacketCapture" or "Start-WebcamRecorder" or
+    "Get-USBKeyStrokes" or "Invoke-KeeThief" or
+    "Get-Keystrokes" or "Invoke-NetRipper" or
+    "Get-EmailItems" or "Invoke-MailSearch" or
+    "Invoke-SearchGAL" or "Get-WebCredentials" or
+    "Start-CaptureServer" or "Invoke-PowerShellIcmp" or
+    "Invoke-PowerShellTcpOneLine" or "Invoke-PowerShellTcpOneLineBind" or
+    "Invoke-PowerShellUdp" or "Invoke-PowerShellUdpOneLine" or
+    "Run-EXEonRemote" or "Download-Execute-PS" or
+    "Out-RundllCommand" or "Set-RemoteWMI" or
+    "Set-DCShadowPermissions" or "Invoke-PowerShellWMI" or
+    "Invoke-Vnc" or "Invoke-LockWorkStation" or
+    "Invoke-EternalBlue" or "Invoke-ShellcodeMSIL" or
+    "Invoke-MetasploitPayload" or "Invoke-DowngradeAccount" or
+    "Invoke-RunAs" or "ExetoText" or
+    "Disable-SecuritySettings" or "Set-MacAttribute" or
+    "Invoke-MS16032" or "Invoke-BypassUACTokenManipulation" or
+    "Invoke-SDCLTBypass" or "Invoke-FodHelperBypass" or
+    "Invoke-EventVwrBypass" or "Invoke-EnvBypass" or
+    "Get-ServiceUnquoted" or "Get-ServiceFilePermission" or
+    "Get-ServicePermission" or
+    "Enable-DuplicateToken" or "Invoke-PsUaCme" or
+    "Invoke-Tater" or "Invoke-WScriptBypassUAC" or
+    "Invoke-AllChecks" or "Find-TrustedDocuments" or
+    "Invoke-Interceptor" or "Invoke-PoshRatHttp" or
+    "Invoke-ExecCommandWMI" or "Invoke-KillProcessWMI" or
+    "Invoke-CreateShareandExecute" or "Invoke-RemoteScriptWithOutput" or
+    "Invoke-SchedJobManipulation" or "Invoke-ServiceManipulation" or
+    "Invoke-PowerOptionsWMI" or "Invoke-DirectoryListing" or
+    "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or
+    "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or
+    "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS" or
+    "Invoke-AzureHound" or "Invoke-SharpHound"
+  ) and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint"
+  ) and
+  not user.id : ("S-1-5-18" or "S-1-5-19")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028.asciidoc
new file mode 100644
index 0000000000..43636a34e3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028.asciidoc
@@ -0,0 +1,146 @@
+[[prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028]]
+=== Potential privilege escalation via CVE-2022-38028
+
+Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijack the print spooler service execution.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* winlogbeat-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential privilege escalation via CVE-2022-38028*
+
+
+CVE-2022-38028 targets the Windows Print Spooler service, a core component managing print jobs. Adversaries exploit this by manipulating specific JavaScript files within system directories to gain elevated privileges. The detection rule identifies unauthorized file presence in critical paths, signaling potential exploitation attempts, leveraging multiple data sources for comprehensive threat detection.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to confirm the presence of the file "MPDW-constraints.js" in the specified critical paths: "?:\\*\\Windows\\system32\\DriVerStoRe\\FiLeRePoSiToRy\\*\\MPDW-constraints.js" or "?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js".
+- Check the file creation and modification timestamps to determine when the file was placed or altered in the system directories.
+- Investigate the source of the file by examining recent user activity and process execution logs around the time the file appeared, focusing on any suspicious or unauthorized actions.
+- Correlate the event with other data sources such as Sysmon, Microsoft Defender for Endpoint, or SentinelOne to identify any related suspicious activities or processes that might indicate exploitation attempts.
+- Assess the risk and impact by determining if the affected system has any sensitive roles or access that could be leveraged by an attacker through privilege escalation.
+- If malicious activity is confirmed, initiate containment measures such as isolating the affected system and conducting a full malware scan to prevent further exploitation.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may place JavaScript files in the monitored directories. Verify the source and integrity of the software to ensure it is from a trusted vendor.
+- System administrators or automated scripts might deploy or modify JavaScript files in these paths for legitimate configuration purposes. Review change management logs to confirm authorized activities.
+- Security tools or system maintenance processes could temporarily create or modify files in these directories. Cross-reference with scheduled tasks or security tool logs to validate these actions.
+- Exclude known benign applications or processes that frequently interact with the specified file paths by creating exceptions in the detection rule to reduce noise.
+- Regularly update the detection rule to incorporate new intelligence on false positives, ensuring it remains effective and relevant.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network immediately to prevent further exploitation or lateral movement by the adversary.
+- Terminate any suspicious processes related to the Windows Print Spooler service to halt ongoing exploitation attempts.
+- Remove unauthorized JavaScript files, specifically "MPDW-constraints.js", from the identified critical paths to eliminate the immediate threat.
+- Apply the latest security patches and updates from Microsoft to address CVE-2022-38028 and ensure the system is protected against known vulnerabilities.
+- Conduct a thorough review of user accounts and privileges on the affected system to identify and revoke any unauthorized privilege escalations.
+- Monitor the network and system logs for any signs of further exploitation attempts or related suspicious activities, using enhanced detection rules.
+- Report the incident to the appropriate internal security team or external authorities if required, providing detailed information about the exploitation attempt and actions taken.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+    file.name : "MPDW-constraints.js" and
+    file.path : (
+        "?:\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
+        "?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js", 
+        "\\Device\\HarddiskVolume*\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
+        "\\Device\\HarddiskVolume*\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js"
+    ) and
+    not process.executable : (
+          "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
+          "?:\\Windows\\System32\\taskhostw.exe"
+    ) and
+    not file.path : (
+        "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js",
+        "\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
new file mode 100644
index 0000000000..190685e1f5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system]]
+=== Potential Ransomware Behavior - High count of Readme files by System
+
+This rule identifies a high number (20) of file creation event by the System virtual process from the same host and with same file name containing keywords similar to ransomware note files and all within a short time period.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Possible investigation steps*
+
+
+- Investigate the content of the readme files.
+- Investigate any file names with unusual extensions.
+- Investigate any incoming network connection to port 445 on this host.
+- Investigate any network logon events to this host.
+- Identify the total number and type of modified files by pid 4.
+- If the number of files is too high and source.ip connecting over SMB is unusual isolate the host and block the used credentials.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- Local file modification from a Kernel mode driver.
+
+
+*Related rules*
+
+
+- Third-party Backup Files Deleted via Unexpected Process - 11ea6bec-ebde-4d71-a8e9-784948f8e3e9
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57
+- Potential Ransomware Note File Dropped via SMB - 02bab13d-fb14-4d7c-b6fe-4a28874d37c5
+- Suspicious File Renamed via SMB - 78e9b5d5-7c07-40a7-a591-3dbbf464c386
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- If any backups were affected:
+  - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:file and host.os.type:windows and process.pid:4 and event.action:creation and
+ file.name:(*read*me* or *README* or *lock* or *LOCK* or *how*to* or *HOW*TO* or *@* or *recover* or *RECOVER* or *decrypt* or *DECRYPT* or *restore* or *RESTORE* or *FILES_BACK* or *files_back*)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity.asciidoc
new file mode 100644
index 0000000000..bee417a544
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity.asciidoc
@@ -0,0 +1,142 @@
+[[prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity]]
+=== Potential Remote Desktop Shadowing Activity
+
+Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-endpoint.events.registry-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing
+* https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 313
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Remote Desktop Shadowing Activity*
+
+
+Remote Desktop Shadowing allows administrators to view or control active RDP sessions, aiding in support and troubleshooting. However, adversaries can exploit this feature to monitor or hijack user sessions without consent. The detection rule identifies suspicious modifications to RDP Shadow registry settings and the execution of specific processes linked to shadowing, signaling potential misuse.
+
+
+*Possible investigation steps*
+
+
+- Review the registry event details to confirm if there was a modification to the RDP Shadow registry path, specifically checking for changes in "HKLM\Software\Policies\Microsoft\Windows NT\Terminal Services\Shadow".
+- Investigate the process events to identify if "RdpSaUacHelper.exe" or "RdpSaProxy.exe" were started by "svchost.exe", which could indicate unauthorized shadowing activity.
+- Check for any instances of "mstsc.exe" being executed with the "/shadow:*" argument, as this could signify an attempt to shadow an RDP session.
+- Correlate the identified processes and registry changes with user activity logs to determine if the actions were authorized or expected as part of legitimate administrative tasks.
+- Analyze network logs for any unusual remote connections or lateral movement patterns that coincide with the timing of the detected shadowing activity.
+- Consult endpoint security solutions like Microsoft Defender for Endpoint or SentinelOne for additional context or alerts related to the same host or user account involved in the shadowing activity.
+
+
+*False positive analysis*
+
+
+- Legitimate administrative activities may trigger alerts when IT staff use RDP Shadowing for support. To manage this, create exceptions for known IT administrator accounts or specific IP addresses.
+- Scheduled maintenance or automated scripts that modify RDP Shadow registry settings can be mistaken for malicious activity. Identify and exclude these processes or scripts from the detection rule.
+- Security software or monitoring tools that interact with RDP sessions might mimic shadowing behavior. Verify these tools and whitelist their processes to prevent false alerts.
+- Training sessions or remote support tools that use RDP Shadowing features can generate alerts. Document and exclude these activities by identifying their unique process names or arguments.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement.
+- Terminate any suspicious processes identified in the alert, such as RdpSaUacHelper.exe, RdpSaProxy.exe, or mstsc.exe with shadowing arguments, to stop potential session hijacking.
+- Revert any unauthorized changes to the RDP Shadow registry settings to their default or secure state to prevent further exploitation.
+- Conduct a thorough review of user accounts and permissions on the affected system to ensure no unauthorized changes have been made, and reset passwords for any compromised accounts.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for RDP activities across the network to detect and respond to similar threats more quickly in the future.
+- Review and update RDP access policies and configurations to ensure they align with best practices, such as enforcing multi-factor authentication and limiting RDP access to only necessary users and systems.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* Identifies the modification of RDP Shadow registry or
+  the execution of processes indicative of active shadow RDP session */
+
+any where host.os.type == "windows" and
+(
+  (event.category == "registry" and event.type == "change" and
+    registry.value : "Shadow" and
+    registry.path : (
+      "*\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow"
+    ) and
+    registry.data.strings : ("1", "0x00000001", "2", "0x00000002", "3", "0x00000003", "4", "0x00000004")
+
+  ) or
+  (event.category == "process" and event.type == "start" and
+     (process.name : ("RdpSaUacHelper.exe", "RdpSaProxy.exe") and process.parent.name : "svchost.exe") or
+     (?process.pe.original_file_name : "mstsc.exe" and process.args : "/shadow:*")
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host.asciidoc
new file mode 100644
index 0000000000..76ac5b215c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host.asciidoc
@@ -0,0 +1,169 @@
+[[prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host]]
+=== Potential Subnet Scanning Activity from Compromised Host
+
+This rule detects potential subnet scanning activity from a compromised host. Subnet scanning is a common reconnaissance technique used by attackers to identify live hosts within a network range. A compromised host may exhibit subnet scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable hosts, or prepare for further exploitation. This rule identifies potential subnet scanning activity by monitoring network connection attempts from a single host to a large number of hosts within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Potential Subnet Scanning Activity from Compromised Host*
+
+
+Subnet scanning is a reconnaissance method used by attackers to map network topology and identify active hosts. Adversaries exploit compromised hosts to perform these scans, seeking vulnerabilities for further attacks. The detection rule identifies such activity by monitoring Linux hosts for numerous connection attempts to different IPs within a short period, indicating potential scanning behavior. This helps in early detection and mitigation of network threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process executable identified in the alert to determine if it is a known or legitimate application that should be making network connections.
+- Examine the destination IP addresses to identify any patterns or known malicious IPs, and check if these IPs are part of the organization's network or external.
+- Investigate the specific host (using the agent.id) to assess if there are any signs of compromise, such as unusual processes or unauthorized access.
+- Correlate the event timestamp with other logs or alerts to identify any concurrent suspicious activities or anomalies on the host.
+- Check for any recent changes or updates on the host that might explain the scanning behavior, such as new software installations or configuration changes.
+
+
+*False positive analysis*
+
+
+- High-volume legitimate network monitoring tools may trigger the rule. Identify and exclude these tools by adding their process executables to an exception list.
+- Automated backup systems that connect to multiple hosts within a short timeframe can be mistaken for scanning activity. Review and exclude these systems by their process executable or agent ID.
+- Security software performing routine network health checks might generate false positives. Verify these activities and create exceptions based on the specific process executable involved.
+- Internal IT scripts or administrative tasks that involve connecting to numerous hosts for maintenance purposes can trigger alerts. Document these tasks and exclude them by process executable or agent ID.
+- Cloud-based services or applications that require frequent connections to various hosts for functionality may appear as scanning. Identify these services and exclude them by their process executable or agent ID.
+
+
+*Response and remediation*
+
+
+- Isolate the compromised host immediately from the network to prevent further scanning and potential lateral movement by the attacker.
+- Terminate any suspicious processes identified by the executable name in the alert to stop ongoing scanning activities.
+- Conduct a thorough examination of the compromised host to identify and remove any malware or unauthorized access tools that may have been installed.
+- Reset credentials and review access permissions for the compromised host to ensure no unauthorized access persists.
+- Update and patch the compromised host and any other vulnerable systems identified during the investigation to close security gaps.
+- Monitor network traffic closely for any signs of continued scanning or other suspicious activities from other hosts, indicating potential further compromise.
+- Escalate the incident to the security operations center (SOC) or incident response team for a comprehensive investigation and to determine if additional hosts are affected.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.network-*
+| keep @timestamp, host.os.type, event.type, event.action, process.executable, destination.ip, agent.id, host.name
+| where
+    @timestamp > now() - 1 hours and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "connection_attempted" and
+    not (
+      process.executable in ("/usr/local/bin/prometheus", "/app/extra/chrome") or
+      process.executable like "/usr/local/prometheus/*/prometheus" or
+      process.executable like "/usr/share/elastic-agent/*" or
+      process.executable like "/var/lib/docker/overlay*connectord" or
+      process.executable like "/opt/rumble/bin/rumble-agent*" or
+      process.executable like "/opt/gitlab/*" or
+      process.executable like "/opt/google/chrome/chrome*"
+    )
+| stats
+    Esql.event_count = count(),
+    Esql.destination_ip_count_distinct = count_distinct(destination.ip),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+  by process.executable
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.destination_ip_count_distinct > 250
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification.asciidoc
new file mode 100644
index 0000000000..757fcb9af8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification]]
+=== Potential System Tampering via File Modification
+
+Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Impact
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential System Tampering via File Modification*
+
+
+This rule identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes.
+- Assess all deleted or modified system critical files and perform a complete recovery of those files to prevent system booting issues.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action, if not immedialy disable the account.
+
+
+*False positive analysis*
+
+
+- Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If important data was encrypted, deleted, or modified, activate your data recovery plan.
+    - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type in ("change", "deletion") and
+ file.name : ("winload.exe", "winlod.efi", "ntoskrnl.exe", "bootmgr") and
+ file.path : ("?:\\Windows\\*", "\\Device\\HarddiskVolume*\\Windows\\*") and
+ not process.executable : ("?:\\Windows\\System32\\poqexec.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..9203bf5649
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications]]
+=== Potentially Successful Okta MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta.system*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Domain: Identity
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+* Data Source: Okta System Logs
+* Resources: Investigation Guide
+
+*Version*: 417
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potentially Successful Okta MFA Bombing via Push Notifications*
+
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+
+*Possible investigation steps:*
+
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+
+*False positive analysis:*
+
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+
+*Response and remediation:*
+
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [ any
+    where event.dataset == "okta.system"
+      and (
+        okta.event_type == "user.mfa.okta_verify.deny_push"
+        or (
+          okta.event_type == "user.authentication.auth_via_mfa"
+          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
+          and okta.outcome.reason == "INVALID_CREDENTIALS"
+        )
+      )
+  ] with runs=5
+  [ any
+    where event.dataset == "okta.system"
+      and okta.event_type in (
+        "user.authentication.sso",
+        "user.authentication.auth_via_mfa",
+        "user.authentication.verify",
+        "user.session.start"
+      )
+      and okta.outcome.result == "SUCCESS"
+  ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-kerberos-ticket-request.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-kerberos-ticket-request.asciidoc
new file mode 100644
index 0000000000..f1158e5d4a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-kerberos-ticket-request.asciidoc
@@ -0,0 +1,163 @@
+[[prebuilt-rule-8-18-14-powershell-kerberos-ticket-request]]
+=== PowerShell Kerberos Ticket Request
+
+Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://cobalt.io/blog/kerberoast-attack-techniques
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Kerberos Ticket Request*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
+
+Accounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute force to crack the user password, which is used to encrypt a Kerberos TGS ticket.
+
+Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to perform Kerberoasting.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate if the script was executed, and if so, which account was targeted.
+- Validate if the account has an SPN associated with it.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if the script has any other functionality that can be potentially malicious.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Review event ID https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769[4769] related to this account and service name for additional information.
+
+
+*False positive analysis*
+
+
+- A possible false positive can be identified if the script content is not malicious/harmful or does not request Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password requirements and policy.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    KerberosRequestorSecurityToken
+  ) and not user.id : ("S-1-5-18" or "S-1-5-20") and
+  not powershell.file.script_block_text : (
+    ("sentinelbreakpoints" and ("Set-PSBreakpoint" or "Set-HookFunctionTabs")) or
+    ("function global" and "\\windows\\sentinel\\4")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-mailbox-collection-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-mailbox-collection-script.asciidoc
new file mode 100644
index 0000000000..a1a33951c3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-mailbox-collection-script.asciidoc
@@ -0,0 +1,181 @@
+[[prebuilt-rule-8-18-14-powershell-mailbox-collection-script]]
+=== PowerShell Mailbox Collection Script
+
+Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/dafthack/MailSniper/blob/master/MailSniper.ps1
+* https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Mailbox Collection Script*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
+
+This rule identifies scripts that contains methods and classes that can be abused to collect emails from local and remote mailboxes.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Determine whether the script was executed and capture relevant information, such as arguments that reveal intent or are indicators of compromise (IoCs).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+  - Assess network data to determine if the host communicated with the exfiltration server.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+
+*Related rules*
+
+
+- Exporting Exchange Mailbox via PowerShell - 6aace640-e631-4870-ba8e-5fdda09325db
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (
+    (
+      powershell.file.script_block_text : (
+        "Microsoft.Office.Interop.Outlook" or
+        "Interop.Outlook.olDefaultFolders" or
+        "olFolderInBox" or
+        "Outlook.Application"
+      ) and powershell.file.script_block_text : ("MAPI" or "GetDefaultFolder" or "GetNamespace" or "Session" or "GetSharedDefaultFolder")
+    ) or
+    (
+      powershell.file.script_block_text : (
+        "Microsoft.Exchange.WebServices.Data.Folder" or
+        "Microsoft.Exchange.WebServices.Data.FileAttachment" or
+        "Microsoft.Exchange.WebServices.Data.ExchangeService"
+      ) and
+      powershell.file.script_block_text : ("FindItems" or "Bind" or "WellKnownFolderName" or "FolderId" or "ItemView" or "PropertySet" or "SearchFilter" or "Attachments")
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities.asciidoc
new file mode 100644
index 0000000000..08dcfc04e4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities.asciidoc
@@ -0,0 +1,175 @@
+[[prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities]]
+=== PowerShell Script with Windows Defender Tampering Capabilities
+
+Identifies PowerShell scripts containing cmdlets and parameters that attackers can abuse to disable Windows Defender features. Attackers can tamper with antivirus to reduce the risk of detection when executing their payloads.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating PowerShell Script with Windows Defender Tampering Capabilities*
+
+
+PowerShell is a powerful scripting language used for task automation and configuration management in Windows environments. Adversaries exploit PowerShell to disable Windows Defender features, reducing detection risks. The detection rule identifies scripts attempting to modify Defender settings, such as disabling real-time monitoring, by analyzing script block text for specific cmdlets and parameters, while excluding legitimate processes and users.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script's execution context, such as the user account, privileges, the role of the system on which it was executed, and any relevant timestamps.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate the origin of the PowerShell script, including its source, download method, and any associated URLs or IP addresses.
+- Use the Get-MpPreference cmdlet to check defender settings for the host. Revert them to the desired state if needed.
+- Check for Files written and executed after the settings were changed.
+
+
+*False positive analysis*
+
+
+- Legitimate administrative scripts may trigger the rule if they use Set-MpPreference cmdlets for valid configuration changes. To handle this, review the script's purpose and source, and consider adding exceptions for trusted scripts or users.
+- Automated system management tools might use similar cmdlets for routine maintenance. Identify these tools and exclude their processes or directories from the rule to prevent unnecessary alerts.
+- Security software updates or installations could temporarily disable certain Defender features. Monitor these activities and whitelist known update processes to avoid false positives.
+- PowerShell scripts executed by system administrators for troubleshooting may appear suspicious. Verify the user ID and script content, and exclude known administrator accounts from the rule if they frequently perform such tasks.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category: "process" and host.os.type:windows and
+(
+  powershell.file.script_block_text: "Set-MpPreference" and
+  powershell.file.script_block_text: (
+    DisableArchiveScanning or DisableBehaviorMonitoring or
+    DisableIntrusionPreventionSystem or DisableIOAVProtection or
+    DisableRemovableDriveScanning or DisableBlockAtFirstSeen or
+    DisableScanningMappedNetworkDrivesForFullScan or
+    DisableScanningNetworkFiles or DisableScriptScanning or
+    DisableRealtimeMonitoring or LowThreatDefaultAction or
+    ModerateThreatDefaultAction or HighThreatDefaultAction
+  )
+) and
+not powershell.file.script_block_text : (
+  ("cmdletization" and "cdxml-Help.xml") or
+  ("function Set-MpPreference" and "Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.SubmitSamplesConsentType")
+) and
+not file.directory : "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM" and
+not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-share-enumeration-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-share-enumeration-script.asciidoc
new file mode 100644
index 0000000000..602ed5e486
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-share-enumeration-script.asciidoc
@@ -0,0 +1,174 @@
+[[prebuilt-rule-8-18-14-powershell-share-enumeration-script]]
+=== PowerShell Share Enumeration Script
+
+Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.advintel.io/post/hunting-for-corporate-insurance-policies-indicators-of-ransom-exfiltrations
+* https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Collection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 114
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Share Enumeration Script*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use PowerShell to enumerate shares to search for sensitive data like documents, scripts, and other kinds of valuable data for encryption, exfiltration, and lateral movement.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Check for additional PowerShell and command line logs that indicate that imported functions were run.
+  - Evaluate which information was potentially mapped and accessed by the attacker.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "Invoke-ShareFinder" or
+    "Invoke-ShareFinderThreaded" or
+    (
+      "shi1_netname" and
+      "shi1_remark"
+    ) or
+    (
+      "NetShareEnum" and
+      "NetApiBufferFree"
+    )
+  ) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Share Discovery
+** ID: T1135
+** Reference URL: https://attack.mitre.org/techniques/T1135/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Network Shared Drive
+** ID: T1039
+** Reference URL: https://attack.mitre.org/techniques/T1039/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
new file mode 100644
index 0000000000..b99ada7f37
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
@@ -0,0 +1,167 @@
+[[prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities]]
+=== PowerShell Suspicious Script with Audio Capture Capabilities
+
+Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Audio Capture Capabilities*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices connected to the victim's computer.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate if the script stores the recorded data locally and determine if anything was recorded.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+- Assess network data to determine if the host communicated with the exfiltration server.
+
+
+*False positive analysis*
+
+
+- Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+
+*Related rules*
+
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Get-MicrophoneAudio" or
+    "WindowsAudioDevice-Powershell-Cmdlet" or
+    (waveInGetNumDevs and mciSendStringA)
+  )
+  and not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+  and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Audio Capture
+** ID: T1123
+** Reference URL: https://attack.mitre.org/techniques/T1123/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
new file mode 100644
index 0000000000..5d20c68b36
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -0,0 +1,171 @@
+[[prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities]]
+=== PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 213
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+- Assess network data to determine if the host communicated with the exfiltration server.
+
+
+*False positive analysis*
+
+
+- Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+
+*Related rules*
+
+
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (powershell.file.script_block_text : (
+    "Windows.Clipboard" or
+    "Windows.Forms.Clipboard" or
+    "Windows.Forms.TextBox"
+   ) and
+   powershell.file.script_block_text : (
+    "]::GetText" or
+    ".Paste()"
+  )) or powershell.file.script_block_text : "Get-Clipboard" and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  ) and
+  not user.id : "S-1-5-18" and
+  not (
+    file.path : *WindowsPowerShell\\Modules\\*.ps1 and
+    file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Clipboard Data
+** ID: T1115
+** Reference URL: https://attack.mitre.org/techniques/T1115/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable.asciidoc
new file mode 100644
index 0000000000..fa9859979e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable.asciidoc
@@ -0,0 +1,133 @@
+[[prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable]]
+=== Privilege Escalation via Windir Environment Variable
+
+Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 313
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Privilege Escalation via Windir Environment Variable*
+
+
+The Windir environment variable points to the Windows directory, crucial for system operations. Adversaries may alter this variable to redirect processes to malicious directories, gaining elevated privileges. The detection rule monitors changes to this variable in the registry, flagging deviations from expected paths like "C:\windows," thus identifying potential privilege escalation attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the registry change event details to identify the specific user account associated with the altered Windir or SystemRoot environment variable. This can be done by examining the registry path and user context in the event data.
+- Check the registry data strings to determine the new path set for the Windir or SystemRoot variable. Investigate if this path points to a known malicious directory or an unexpected location.
+- Correlate the event with other recent registry changes or system events on the same host to identify any patterns or additional suspicious activities that might indicate a broader attack.
+- Investigate the process or application that initiated the registry change by reviewing process creation logs or command-line arguments around the time of the event. This can help identify the source of the change.
+- Assess the affected system for any signs of compromise or unauthorized access, such as unusual network connections, unexpected running processes, or new user accounts.
+- Consult threat intelligence sources to determine if the observed behavior matches any known attack patterns or campaigns, particularly those involving privilege escalation techniques.
+- If possible, restore the Windir or SystemRoot environment variable to its expected value and monitor the system for any further unauthorized changes.
+
+
+*False positive analysis*
+
+
+- System updates or patches may temporarily alter the Windir environment variable. Monitor for these events during known maintenance windows and consider excluding them from alerts.
+- Custom scripts or applications that modify environment variables for legitimate purposes can trigger false positives. Identify these scripts and whitelist their activity in the detection rule.
+- User profile migrations or system restorations might change the Windir path. Exclude these operations if they are part of routine IT processes.
+- Virtual environments or sandboxed applications may use different Windir paths. Verify these environments and adjust the detection rule to accommodate their specific configurations.
+- Administrative tools that modify user environments for configuration management can cause alerts. Document these tools and create exceptions for their expected behavior.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement.
+- Revert the Windir environment variable to its legitimate value, typically "C:\windows", to restore normal system operations.
+- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any malicious software or scripts.
+- Review recent user activity and system logs to identify any unauthorized access or changes, focusing on the time frame around the detected registry change.
+- Reset passwords for any user accounts that may have been compromised, especially those with elevated privileges.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring on the affected system and similar endpoints to detect any further attempts to alter critical environment variables or other suspicious activities.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+registry.value : ("windir", "systemroot") and registry.data.strings != null and
+registry.path : (
+    "*\\Environment\\windir",
+    "*\\Environment\\systemroot"
+    ) and
+ not registry.data.strings : ("C:\\windows", "%SystemRoot%")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-execution-via-file-shares.asciidoc
new file mode 100644
index 0000000000..9cc8d66ece
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-execution-via-file-shares.asciidoc
@@ -0,0 +1,162 @@
+[[prebuilt-rule-8-18-14-remote-execution-via-file-shares]]
+=== Remote Execution via File Shares
+
+Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-endpoint.events.file-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html
+* https://www.elastic.co/security-labs/hunting-for-lateral-movement-using-event-query-language
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 120
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote Execution via File Shares*
+
+
+Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review adjacent login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Review the privileges needed to write to the network share and restrict write access as needed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+  [file where host.os.type == "windows" and event.type in ("creation", "change") and 
+   process.pid == 4 and (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start" and
+    not (
+      (
+        process.code_signature.trusted == true and
+        process.code_signature.subject_name : (
+              "Veeam Software Group GmbH",
+              "Elasticsearch, Inc.",
+              "PDQ.com Corporation",
+              "CrowdStrike, Inc.",
+              "Microsoft Windows Hardware Compatibility Publisher",
+              "ZOHO Corporation Private Limited",
+              "BeyondTrust Corporation", 
+              "CyberArk Software Ltd.", 
+              "Sophos Ltd"
+        )
+      ) or
+      (
+        process.executable : (
+          "?:\\Windows\\ccmsetup\\ccmsetup.exe",
+          "?:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta*.exe",
+          "?:\\Windows\\CAInvokerService.exe"
+        ) and process.code_signature.trusted == true
+      ) or
+      (
+        process.executable : "G:\\SMS_*\\srvboot.exe" and 
+        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation"
+      )
+    )
+  ] by host.id, process.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-file-download-via-powershell.asciidoc
new file mode 100644
index 0000000000..1dfe4b0ae1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-remote-file-download-via-powershell.asciidoc
@@ -0,0 +1,166 @@
+[[prebuilt-rule-8-18-14-remote-file-download-via-powershell]]
+=== Remote File Download via PowerShell
+
+Identifies powershell.exe being used to download an executable file from an untrusted remote destination.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-endpoint.events.file-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 114
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via PowerShell*
+
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
+
+PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Check the reputation of the domain or IP address used to host the downloaded file.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- Administrators can use PowerShell legitimately to download executable and script files. Analysts can dismiss the alert if the Administrator is aware of the activity and the triage has not identified suspicious or malicious files.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.entity_id with maxspan=30s
+[network where host.os.type == "windows" and 
+  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+  network.protocol == "dns" and
+  not dns.question.name : (
+        "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com",
+        "metadata.google.internal", "dist.nuget.org", "artifacts.elastic.co", "*.digicert.com",
+        "*.chocolatey.org", "outlook.office365.com", "cdn.oneget.org", "ci.dot.net",
+        "packages.icinga.com", "login.microsoftonline.com", "*.gov", "*.azure.com", "*.python.org",
+        "dl.google.com", "sensor.cloud.tenable.com", "*.azurefd.net", "*.office.net", "*.anac*",
+        "aka.ms", "dot.net", "*.visualstudio.com", "*.local") and
+  not user.id == "S-1-5-18" and
+  /* Filter out NetBIOS/LLMNR-style names (e.g. host, localhost, etc.) */
+  dns.question.name regex """.*\.[a-zA-Z]{2,5}"""]
+[file where host.os.type == "windows" and event.type == "creation" and
+  process.name : "powershell.exe" and 
+  (file.extension : ("exe", "dll", "ps1", "bat") or file.Ext.header_bytes : "4d5a*") and
+  not file.name : "__PSScriptPolicy*.ps1" and
+  not file.path : (
+        "?:\\Users\\*\\AppData\\Local\\Temp\\????????.dll",
+        "?:\\Users\\*\\AppData\\Local\\Temp\\*\\????????.dll",
+        "?:\\Windows\\TEMP\\ansible-tmp-*\\AnsiballZ*.ps1"
+  ) and
+  not user.id == "S-1-5-18"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..f50091ec1b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes]]
+=== ScreenConnect Server Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating ScreenConnect Server Spawning Suspicious Processes*
+
+
+ScreenConnect, a remote support tool, allows administrators to control systems remotely. Adversaries may exploit this by executing unauthorized commands or scripts, potentially using it as a backdoor. The detection rule identifies unusual child processes like command shells spawned by the ScreenConnect service, signaling possible exploitation or web shell activity, thus aiding in early threat detection.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to confirm the parent process is ScreenConnect.Service.exe and identify the suspicious child process name, such as cmd.exe or powershell.exe.
+- Check the timestamp of the process start event to determine when the suspicious activity occurred and correlate it with any other unusual activities or alerts around the same time.
+- Investigate the user account associated with the process to determine if it is a legitimate user or potentially compromised.
+- Examine the command line arguments of the spawned process to identify any malicious or unauthorized commands being executed.
+- Review network logs for any unusual outbound connections initiated by the ScreenConnect service or the suspicious child process, which may indicate data exfiltration or communication with a command and control server.
+- Analyze the system for any additional indicators of compromise, such as unexpected file modifications or the presence of web shells, to assess the extent of the potential breach.
+
+
+*False positive analysis*
+
+
+- Legitimate administrative tasks using command shells or scripting tools like cmd.exe or powershell.exe may trigger the rule. To manage this, create exceptions for known administrative scripts or tasks that are regularly executed by trusted users.
+- Automated maintenance scripts that utilize ScreenConnect for legitimate purposes can be mistaken for suspicious activity. Identify these scripts and whitelist their execution paths or specific process names to prevent false alerts.
+- Software updates or installations that require command line execution through ScreenConnect might be flagged. Document these processes and exclude them from the rule by specifying the associated process names or hashes.
+- Security tools or monitoring solutions that interact with ScreenConnect for legitimate scanning or logging purposes may inadvertently trigger the rule. Verify these tools and add them to an exception list based on their process identifiers or parent-child process relationships.
+- Training or demonstration sessions using ScreenConnect to showcase command line features could be misinterpreted as threats. Schedule these sessions and temporarily adjust the rule sensitivity or disable it during the known timeframes to avoid false positives.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Terminate any suspicious processes identified as being spawned by ScreenConnect.Service.exe, such as cmd.exe or powershell.exe, to halt any ongoing malicious activity.
+- Conduct a thorough review of recent ScreenConnect session logs to identify unauthorized access or unusual activity patterns, and revoke any compromised credentials.
+- Scan the affected system for additional indicators of compromise, such as web shells or other malware, using endpoint detection and response tools.
+- Apply security patches and updates to the ScreenConnect server and any other vulnerable applications to mitigate exploitation risks.
+- Restore the system from a known good backup if evidence of compromise is confirmed, ensuring that the backup is free from malicious artifacts.
+- Report the incident to the appropriate internal security team or external authorities if required, providing them with detailed findings and evidence for further investigation.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "ScreenConnect.Service.exe" and
+  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "csc.exe") or
+  ?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
new file mode 100644
index 0000000000..936a33bf9d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key]]
+=== Successful SSH Authentication from Unusual SSH Public Key
+
+This rule leverages the new_terms rule type to detect successful SSH authentications via a public key that has not been seen in the last 10 days. Public key authentication is a secure method for authenticating users to a server. Monitoring unusual public key authentication events can help detect unauthorized access attempts or suspicious activity on the system.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-system.auth-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Successful SSH Authentication from Unusual SSH Public Key*
+
+
+SSH public key authentication is a secure method for accessing Linux systems, relying on cryptographic keys rather than passwords. Adversaries may exploit this by using stolen or unauthorized keys to gain access. The detection rule identifies successful logins using new public keys, unseen in the past 10 days, signaling potential unauthorized access attempts. This helps in early detection of suspicious activities, aligning with threat tactics like Initial Access.
+
+
+*Possible investigation steps*
+
+
+- Review the specific SSH login event details, focusing on the event.category, event.action, and event.outcome fields to confirm the successful authentication via public key.
+- Identify the source IP address and user account associated with the login event to determine if they are known or expected.
+- Check the system.auth.ssh.method field to ensure the authentication method was indeed public key and not another method.
+- Investigate the history of the public key used for authentication by searching logs for any previous occurrences or related activities within the last 10 days.
+- Correlate the event with other security logs or alerts from the same host or user to identify any patterns or additional suspicious activities.
+- Assess the risk by considering the context of the login, such as the time of access, the location of the source IP, and any recent changes in user behavior or system configurations.
+- If unauthorized access is suspected, initiate incident response procedures, including revoking the public key, notifying affected parties, and conducting a thorough security review of the system.
+
+
+*False positive analysis*
+
+
+- Frequent logins from known automation scripts or services using rotating SSH keys can trigger false positives. To manage this, identify these services and add their public keys to an exception list.
+- Developers or system administrators who regularly update their SSH keys for security reasons may cause alerts. Maintain a record of authorized personnel and their key update schedules to exclude these events.
+- Temporary access granted to third-party vendors or contractors might appear as unusual activity. Ensure that any temporary access is documented and keys are added to an exception list during the access period.
+- Test environments where SSH keys are frequently generated and used for various testing purposes can lead to false positives. Implement a separate monitoring policy for test environments to reduce noise in production alerts.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Revoke the unauthorized SSH public key from the system's authorized_keys file to block further access using that key.
+- Conduct a thorough review of recent login activities and system logs to identify any additional unauthorized access or suspicious activities that may have occurred.
+- Change passwords and regenerate SSH keys for all legitimate users on the affected system to ensure no compromised credentials remain in use.
+- Notify the security team and relevant stakeholders about the incident for awareness and further investigation.
+- Implement additional monitoring on the affected system and related network segments to detect any further suspicious activities or attempts to regain access.
+- Review and update access control policies and SSH key management practices to prevent similar incidents in the future, ensuring that only authorized keys are allowed and regularly audited.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from one of the following integrations:
+- Filebeat
+
+
+*Filebeat Setup*
+
+Filebeat is a lightweight shipper for forwarding and centralizing log data. Installed as an agent on your servers, Filebeat monitors the log files or locations that you specify, collects log events, and forwards them either to Elasticsearch or Logstash for indexing.
+
+
+*The following steps should be executed in order to add the Filebeat for the Linux System:*
+
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html[helper guide].
+- To run Filebeat on Docker follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-docker.html[helper guide].
+- To run Filebeat on Kubernetes follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html[helper guide].
+- For quick start information for Filebeat refer to the https://www.elastic.co/guide/en/beats/filebeat/8.11/filebeat-installation-configuration.html[helper guide].
+- For complete Setup and Run Filebeat information refer to the https://www.elastic.co/guide/en/beats/filebeat/current/setting-up-and-running.html[helper guide].
+
+
+*Rule Specific Setup Note*
+
+- This rule requires the Filebeat System Module to be enabled.
+- The system module collects and parses logs created by the system logging service of common Unix/Linux based distributions.
+- To run the system module of Filebeat on Linux follow the setup instructions in the https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:authentication and host.os.type:linux and event.action:ssh_login and event.outcome:success and system.auth.ssh.method:publickey
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes.asciidoc
new file mode 100644
index 0000000000..22eb191941
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes]]
+=== Suspicious Access to LDAP Attributes
+
+Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-system.security*
+* logs-windows.forwarded*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Windows Security Event Logs
+* Data Source: Active Directory
+* Data Source: Windows
+* Resources: Investigation Guide
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Access to LDAP Attributes*
+
+
+LDAP (Lightweight Directory Access Protocol) is crucial for querying and modifying directory services like Active Directory, which stores user credentials and permissions. Adversaries exploit LDAP to enumerate directory attributes, seeking vulnerabilities or sensitive data. The detection rule identifies unusual read access patterns, such as excessive attribute queries, which may indicate reconnaissance or privilege escalation attempts.
+
+
+*Possible investigation steps*
+
+
+- Review the event logs for the specific event code 4662 to gather details about the suspicious read access, focusing on the winlog.event_data.Properties field to understand which attributes were accessed.
+- Identify the user associated with the suspicious activity by examining the winlog.event_data.SubjectUserSid field, and determine if this user has a legitimate reason to access a high number of Active Directory object attributes.
+- Check the user's recent activity and login history to identify any unusual patterns or anomalies that could indicate compromised credentials or unauthorized access.
+- Investigate the source machine from which the LDAP queries originated to determine if it is a known and trusted device or if it shows signs of compromise or unauthorized use.
+- Correlate this event with other security alerts or logs to identify if this activity is part of a larger pattern of reconnaissance or privilege escalation attempts within the network.
+
+
+*False positive analysis*
+
+
+- Regular system maintenance or updates may trigger high attribute read access. Exclude known maintenance accounts from the rule to prevent false alerts.
+- Automated scripts or applications that query Active Directory for legitimate purposes can cause excessive attribute reads. Identify and whitelist these scripts or applications to reduce noise.
+- Security audits or compliance checks often involve extensive directory queries. Coordinate with IT and security teams to recognize these activities and adjust the rule to exclude them.
+- Service accounts with legitimate high-volume access patterns should be reviewed and, if deemed non-threatening, added to an exception list to avoid unnecessary alerts.
+- Consider the context of the access, such as time of day or associated user activity, to differentiate between normal and suspicious behavior. Adjust the rule to account for these patterns where applicable.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or data exfiltration.
+- Conduct a thorough review of the user account associated with the suspicious LDAP access to determine if it has been compromised. Reset the account credentials and enforce multi-factor authentication.
+- Analyze the event logs to identify any other systems or accounts that may have been accessed using similar methods, and apply the same containment measures.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the full scope of the breach.
+- Implement additional monitoring on LDAP queries and Active Directory access to detect similar patterns of excessive attribute queries in the future.
+- Review and tighten access controls and permissions within Active Directory to ensure that only necessary attributes are accessible to users based on their roles.
+- Conduct a post-incident review to identify any gaps in security controls and update policies or procedures to prevent recurrence of similar threats.
+
+==== Setup
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where event.code == "4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and
+ winlog.event_data.AccessMaskDescription == "Read Property" and length(winlog.event_data.Properties) >= 2000
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
new file mode 100644
index 0000000000..94f6302306
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
@@ -0,0 +1,131 @@
+[[prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph]]
+=== Suspicious Email Access by First-Party Application via Microsoft Graph
+
+Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-azure.graphactivitylogs-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/
+* https://github.com/dirkjanm/ROADtools
+* https://dirkjanm.io/phishing-for-microsoft-entra-primary-refresh-tokens/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: Azure
+* Data Source: Microsoft Graph
+* Data Source: Microsoft Graph Activity Logs
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Email Access by First-Party Application via Microsoft Graph*
+
+
+This rule detects instances where a previously unseen or rare Microsoft Graph application client ID accesses email-related APIs, such as `/me/messages`, `/sendMail`, or `/mailFolders/inbox/messages`. These accesses are performed via delegated user credentials using common OAuth scopes like `Mail.Read`, `Mail.ReadWrite`, `Mail.Send`, or `email`. This activity may indicate unauthorized use of a newly consented or compromised application to read or exfiltrate mail content. This is a New Terms rule that only signals if the application ID (`azure.graphactivitylogs.properties.app_id`) and user principal object ID (`azure.graphactivitylogs.properties.user_principal_object_id`) have not been seen doing this activity in the last 14 days.
+
+
+*Possible Investigation Steps:*
+
+
+- `azure.graphactivitylogs.properties.app_id`: Investigate the application ID involved. Is it known and sanctioned in your tenant? Pivot to Azure Portal → Enterprise Applications → Search by App ID to determine app details, publisher, and consent status.
+- `azure.graphactivitylogs.properties.scopes`: Review the scopes requested by the application. Email-related scopes such as `Mail.ReadWrite` and `Mail.Send` are especially sensitive and suggest the app is interacting with mail content.
+- `url.path` / `azure.graphactivitylogs.properties.requestUri`: Determine exactly which mail-related APIs were accessed (e.g., reading inbox, sending messages, enumerating folders).
+- `user.id`: Identify the user whose credentials were used. Determine if the user recently consented to a new app, clicked a phishing link, or reported suspicious activity.
+- `user_agent.original`: Check for suspicious automation tools (e.g., `python-requests`, `curl`, non-browser agents), which may suggest scripted access.
+- `source.ip` and `client.geo`: Investigate the source IP and geography. Look for unusual access from unexpected countries, VPS providers, or anonymizing services.
+- `http.request.method`: Determine intent based on HTTP method — `GET` (reading), `POST` (sending), `PATCH`/`DELETE` (modifying/removing messages).
+- `token_issued_at` and `@timestamp`: Determine how long the token has been active and whether access is ongoing or recent.
+- `azure.graphactivitylogs.properties.c_sid`: Use the session correlation ID to identify other related activity in the same session. This may help identify if the app is accessing multiple users' mailboxes or if the same user is accessing multiple apps.
+- Correlate with Microsoft Entra ID (`azure.auditlogs` and `azure.signinlogs`) to determine whether:
+  - The app was recently granted admin or user consent
+  - Risky sign-ins occurred just prior to or after mail access
+  - The same IP or app ID appears across multiple users
+
+
+*False Positive Analysis*
+
+
+- New legitimate apps may appear after a user consents via OAuth. Developers, third-party tools, or IT-supplied utilities may access mail APIs if users consent.
+- Users leveraging Microsoft development environments (e.g., Visual Studio Code) may trigger this behavior with delegated `.default` permissions.
+- Admin-approved apps deployed via conditional access may trigger similar access logs if not previously seen in detection baselines.
+
+
+*Response and Remediation*
+
+
+- If access is unauthorized or unexpected:
+  - Revoke the app's consent in Azure AD via the Enterprise Applications blade.
+  - Revoke user refresh tokens via Microsoft Entra or PowerShell.
+  - Investigate the user's session and alert them to possible phishing or OAuth consent abuse.
+- Review and restrict risky OAuth permissions in Conditional Access and App Governance policies.
+- Add known, trusted app IDs to a detection allowlist to reduce noise in the future.
+- Continue monitoring the app ID for additional usage across the tenant or from suspicious IPs.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "azure.graphactivitylogs" and
+azure.graphactivitylogs.properties.app_id: * and
+azure.graphactivitylogs.result_signature: 200 and
+azure.graphactivitylogs.properties.c_idtyp: "user" and
+azure.graphactivitylogs.properties.client_auth_method: 0 and
+http.request.method: (GET or POST or PUT or PATCH or DELETE) and (
+  url.path: (/v1.0/me/*cc or /v1.0/users/*) and
+  (
+    url.path: (*mail* or *messages* or *inbox*) or
+    azure.graphactivitylogs.properties.requestUri: (*mail* or *messages* or *inbox*)
+  ) or
+  azure.graphactivitylogs.properties.scopes: (
+    "Mail.Read" or "Mail.ReadWrite" or "Mail.Send" or "email"
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache.asciidoc
new file mode 100644
index 0000000000..290d125302
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache.asciidoc
@@ -0,0 +1,160 @@
+[[prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache]]
+=== Suspicious Execution from INET Cache
+
+Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Execution from INET Cache*
+
+
+The INetCache folder stores temporary internet files, which can be exploited by adversaries to execute malicious payloads delivered via WININET. Attackers may disguise malware as legitimate files cached during browsing. The detection rule identifies suspicious processes initiated from this cache, especially when launched by common file explorers, signaling potential initial access or command and control activities.
+
+
+*Possible investigation steps*
+
+
+- Review the process details to confirm the executable path and arguments match the INetCache folder pattern specified in the query.
+- Identify the parent process, such as explorer.exe, winrar.exe, 7zFM.exe, or Bandizip.exe, to determine if the process launch is consistent with typical user behavior or potentially malicious activity.
+- Check the user account associated with the process to assess if the activity aligns with the user's normal behavior or if the account may be compromised.
+- Investigate the file in the INetCache directory for known malware signatures or anomalies using antivirus or endpoint detection tools.
+- Analyze network activity from the host to identify any suspicious connections that may indicate command and control communication.
+- Correlate the event with other security alerts or logs to identify patterns or additional indicators of compromise related to the initial access or command and control tactics.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may temporarily use the INetCache folder for storing executable files. Users can create exceptions for known update processes by identifying their specific executable paths and excluding them from the rule.
+- Some browser extensions or plugins might cache executable files in the INetCache folder during normal operations. Users should monitor and whitelist these extensions if they are verified as safe and frequently trigger alerts.
+- Automated scripts or tools that interact with web content might inadvertently store executables in the INetCache folder. Users can adjust the rule to exclude these scripts by specifying their parent process names or paths.
+- Certain enterprise applications may use the INetCache folder for legitimate purposes. Users should collaborate with IT departments to identify these applications and configure exceptions based on their unique process signatures.
+- Regularly review and update the list of excluded processes to ensure that only verified and non-threatening activities are exempt from triggering alerts.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further communication with potential command and control servers.
+- Terminate any suspicious processes identified as originating from the INetCache folder to halt any ongoing malicious activity.
+- Delete any malicious files found within the INetCache directory to remove the immediate threat.
+- Conduct a full antivirus and antimalware scan on the affected system to identify and remove any additional threats.
+- Review and analyze recent email logs and web browsing history to identify potential phishing attempts or malicious downloads that may have led to the initial compromise.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for the INetCache directory and related processes to detect similar threats in the future.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
+  (
+    process.args : "*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
+    process.executable : (
+      "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
+
+      /* Crowdstrike specific condition as it uses NT Object paths */
+      "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
+    )
+  ) and
+  not process.executable : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Windows\\System32\\mspaint.exe",
+        "?:\\Windows\\System32\\notepad.exe",
+
+        /* Crowdstrike specific exclusion as it uses NT Object paths */
+        "\\Device\\HarddiskVolume*\\Program Files\\*.exe",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\mspaint.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\notepad.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution.asciidoc
new file mode 100644
index 0000000000..994529aeaa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution]]
+=== Suspicious Microsoft Antimalware Service Execution
+
+Identifies suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances. This may indicate an attempt to evade defenses through DLL side-loading or by masquerading as the antimalware process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+* Dennis Perto
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Microsoft Antimalware Service Execution*
+
+
+The Microsoft Antimalware Service Executable, a core component of Windows Defender, is crucial for real-time protection against malware. Adversaries exploit its trust by renaming it or executing it from non-standard paths to load malicious DLLs, bypassing security measures. The detection rule identifies such anomalies by monitoring process names and paths, flagging deviations from expected behavior to uncover potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details to confirm if the process name is MsMpEng.exe but is executing from a non-standard path. Check the process.executable field to identify the exact path and verify if it deviates from the expected directories.
+- Investigate the parent process of the suspicious MsMpEng.exe instance to determine how it was initiated. This can provide insights into whether the process was started by a legitimate application or a potentially malicious one.
+- Examine the system for any recent file modifications or creations in the directory where the suspicious MsMpEng.exe is located. This can help identify if a malicious DLL was recently placed in the same directory.
+- Check for any network connections or communications initiated by the suspicious MsMpEng.exe process. This can help determine if the process is attempting to communicate with external servers, which may indicate malicious activity.
+- Look for any other processes or activities on the host that may indicate compromise, such as unusual user account activity or other processes running from unexpected locations. This can help assess the broader impact of the potential threat.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may temporarily rename or relocate the Microsoft Antimalware Service Executable. Users should verify if any software updates or installations occurred around the time of the alert and consider excluding these paths if they are known and trusted.
+- Custom security or IT management tools might execute the executable from non-standard paths for monitoring or testing purposes. Confirm with IT or security teams if such tools are in use and add these paths to the exclusion list if they are verified as safe.
+- Virtualization or sandbox environments may replicate the executable in different locations for testing or analysis. Check if the environment is part of a controlled setup and exclude these paths if they are part of legitimate operations.
+- Backup or recovery processes might involve copying the executable to alternate locations. Ensure these processes are legitimate and consider excluding these paths if they are part of routine operations.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further spread of the potential threat.
+- Terminate any suspicious processes identified by the detection rule, specifically those involving MsMpEng.exe running from non-standard paths.
+- Conduct a thorough scan of the affected system using an updated antivirus or endpoint detection and response (EDR) tool to identify and remove any malicious DLLs or other malware.
+- Review and restore any altered or deleted system files from a known good backup to ensure system integrity.
+- Investigate the source of the DLL side-loading attempt to determine if it was part of a broader attack campaign, and gather forensic evidence for further analysis.
+- Escalate the incident to the security operations center (SOC) or incident response team for a deeper investigation and to assess the need for further containment measures.
+- Implement additional monitoring and alerting for similar anomalies in process execution paths to enhance detection capabilities and prevent recurrence.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or
+  (
+    process.name : "MsMpEng.exe" and
+    not process.executable : (
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+            "?:\\Program Files\\Windows Defender\\*.exe",
+            "?:\\Program Files (x86)\\Windows Defender\\*.exe",
+            "?:\\Program Files\\Microsoft Security Client\\*.exe",
+            "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe",
+
+            /* Crowdstrike specific exclusion as it uses NT Object paths */
+            "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files (x86)\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Security Client\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files (x86)\\Microsoft Security Client\\*.exe"
+    )
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
new file mode 100644
index 0000000000..a915474a05
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution]]
+=== Suspicious Microsoft Diagnostics Wizard Execution
+
+Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-crowdstrike.fdr*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/nao_sec/status/1530196847679401984
+* https://lolbas-project.github.io/lolbas/Binaries/Msdt/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: Crowdstrike
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Microsoft Diagnostics Wizard Execution*
+
+
+The Microsoft Diagnostics Troubleshooting Wizard (MSDT) is a legitimate tool used for diagnosing and resolving issues within Windows environments. However, adversaries can exploit MSDT to execute malicious commands by manipulating its process arguments, effectively using it as a proxy for harmful activities. The detection rule identifies such abuse by monitoring for unusual execution patterns, such as atypical file paths, unexpected parent processes, and non-standard executable locations, which are indicative of potential misuse. This proactive detection helps in mitigating risks associated with defense evasion tactics.
+
+
+*Possible investigation steps*
+
+
+- Review the process arguments to identify any suspicious patterns, such as "IT_RebrowseForFile=*", "ms-msdt:/id", "ms-msdt:-id", or "*FromBase64*", which may indicate malicious intent.
+- Examine the parent process of msdt.exe to determine if it was launched by an unexpected or potentially malicious process like cmd.exe, powershell.exe, or mshta.exe.
+- Check the file path of the msdt.exe executable to ensure it matches the standard locations (?:\Windows\system32\msdt.exe or ?:\Windows\SysWOW64\msdt.exe) and investigate any deviations.
+- Investigate the user account associated with the process execution to determine if the activity aligns with their typical behavior or if it appears suspicious.
+- Correlate the event with other security alerts or logs from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related malicious activities or patterns.
+- Assess the risk score and severity of the alert to prioritize the investigation and determine if immediate action is required to mitigate potential threats.
+
+
+*False positive analysis*
+
+
+- Legitimate troubleshooting activities by IT staff using MSDT may trigger alerts. To manage this, create exceptions for known IT user accounts or specific machines frequently used for diagnostics.
+- Automated scripts or software updates that utilize MSDT for legitimate purposes can cause false positives. Identify these scripts and whitelist their execution paths or parent processes.
+- Custom diagnostic tools that leverage MSDT might be flagged. Review these tools and exclude their specific process arguments or executable paths if they are verified as safe.
+- Non-standard installations of MSDT in custom environments could be misidentified. Ensure that any legitimate non-standard paths are documented and excluded from monitoring.
+- Frequent use of MSDT in virtualized environments for testing purposes may lead to alerts. Consider excluding these environments or specific virtual machines from the rule.
+
+
+*Response and remediation*
+
+
+- Isolate the affected system from the network to prevent further malicious activity and lateral movement.
+- Terminate the suspicious msdt.exe process to stop any ongoing malicious execution.
+- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or processes.
+- Review and analyze the process arguments and parent processes associated with the msdt.exe execution to identify potential entry points or related malicious activities.
+- Restore any affected files or system components from a known good backup to ensure system integrity.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if additional systems are compromised.
+- Implement enhanced monitoring and logging for msdt.exe and related processes to detect and respond to similar threats in the future.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (?process.pe.original_file_name == "msdt.exe" or process.name : "msdt.exe") and
+  (
+    process.args : ("IT_RebrowseForFile=*", "*FromBase64*", "*/../../../*", "*PCWDiagnostic*") or
+    (
+      process.args : "-af" and process.args : "/skip" and
+      process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
+      process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml", "PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*")
+    ) or
+
+    (process.pe.original_file_name == "msdt.exe" and not process.name : "msdt.exe" and process.name != null) or
+
+    (
+      ?process.pe.original_file_name == "msdt.exe" and
+      not process.executable : (
+        "?:\\Windows\\system32\\msdt.exe",
+        "?:\\Windows\\SysWOW64\\msdt.exe",
+        /* Crowdstrike specific exclusion as it uses NT Object paths */
+        "\\Device\\HarddiskVolume*\\Windows\\system32\\msdt.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\msdt.exe"
+      )
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification.asciidoc
new file mode 100644
index 0000000000..cd00378f8c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification.asciidoc
@@ -0,0 +1,184 @@
+[[prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification]]
+=== Suspicious Startup Shell Folder Modification
+
+Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign
+* https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 318
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Startup Shell Folder Modification*
+
+
+Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review the source process and related file tied to the Windows Registry entry.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based on new software installations, patches, or other network administrator activity. Before undertaking further investigation, it should be verified that this activity is not benign.
+
+
+*Related rules*
+
+
+- Startup or Run Key Registry Modification - 97fc44d3-8dae-4019-ae83-298c3015600f
+- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+ registry.value : ("Common Startup", "Startup") and
+ registry.path : (
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "HKCU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKCU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
+     ) and
+  registry.data.strings != null and
+  /* Normal Startup Folder Paths */
+  not registry.data.strings : (
+           "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "\\\\*"
+           )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-file-ownership-change.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-file-ownership-change.asciidoc
new file mode 100644
index 0000000000..bd776765b7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-file-ownership-change.asciidoc
@@ -0,0 +1,131 @@
+[[prebuilt-rule-8-18-14-system-file-ownership-change]]
+=== System File Ownership Change
+
+Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating System File Ownership Change*
+
+
+Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
+
+
+*Possible investigation steps*
+
+
+- Assess the ownership target file or directory and identify if it's a system critical file.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- System updates, backup software and uninstallers tend to modify files ownership.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+   (process.name : "icacls.exe" and process.args : "/reset") or
+   (process.name : "takeown.exe" and process.args : "/f") or
+   (process.name : "icacls.exe" and process.args : "/grant" and process.args : "Everyone:F")
+   ) and
+   process.command_line : "*.exe *C:\\Windows\\*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
+* Sub-technique:
+** Name: Windows File and Directory Permissions Modification
+** ID: T1222.001
+** Reference URL: https://attack.mitre.org/techniques/T1222/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query.asciidoc
new file mode 100644
index 0000000000..6510f978cb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query.asciidoc
@@ -0,0 +1,181 @@
+[[prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query]]
+=== System Public IP Discovery via DNS Query
+
+Identifies DNS queries to known public IP address lookup web services. Malwares tend to perform this action to assess potential targets.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.network-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-crowdstrike.fdr*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1016/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+* Data Source: Sysmon
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating System Public IP Discovery via DNS Query*
+
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes or malicious scripts.
+- Verify if the executed process is persistent on the host like common mechanisms Startup folder, task or Run key.
+- Review any unusual network, files or registry events by the same process.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
+
+
+*False positive analysis*
+
+
+- Trusted domain from an expected process running in the environment.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Immediately block the identified indicators of compromise (IoCs).
+- Implement any temporary network rules, procedures, and segmentation required to contain the attack.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Update firewall rules to be more restrictive.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and dns.question.name != null and process.name != null and
+(
+  process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
+  "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "python.exe", "regsvr32.exe", "dllhost.exe",
+  "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com") or
+
+  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
+
+  ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
+
+  ?process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
+ ) and
+ dns.question.name :
+         (
+          "ip-api.com",
+          "checkip.dyndns.org",
+          "api.ipify.org",
+          "api.ipify.com",
+          "whatismyip.akamai.com",
+          "bot.whatismyipaddress.com",
+          "ifcfg.me",
+          "ident.me",
+          "ipof.in",
+          "ip.tyk.nu",
+          "icanhazip.com",
+          "curlmyip.com",
+          "wgetip.com",
+          "eth0.me",
+          "ipecho.net",
+          "ip.appspot.com",
+          "api.myip.com",
+          "geoiptool.com",
+          "api.2ip.ua",
+          "api.ip.sb",
+          "ipinfo.io",
+          "checkip.amazonaws.com",
+          "wtfismyip.com",
+          "iplogger.*",
+          "freegeoip.net",
+          "freegeoip.app",
+          "ipinfo.io",
+          "geoplugin.net",
+          "myip.dnsomatic.com",
+          "www.geoplugin.net",
+          "api64.ipify.org",
+          "ip4.seeip.org",
+          "*.geojs.io",
+          "*portmap.io",
+          "api.2ip.ua",
+          "api.db-ip.com",
+          "geolocation-db.com",
+          "httpbin.org",
+          "myip.opendns.com"
+         )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: DNS
+** ID: T1071.004
+** Reference URL: https://attack.mitre.org/techniques/T1071/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-untrusted-driver-loaded.asciidoc
new file mode 100644
index 0000000000..5545e17c0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-untrusted-driver-loaded.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-18-14-untrusted-driver-loaded]]
+=== Untrusted Driver Loaded
+
+Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/hfiref0x/TDL
+* https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 13
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Untrusted Driver Loaded*
+
+
+Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. 
+
+This protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.
+
+This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/current/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
+  - Identify the path that the driver was loaded from. If you're using Elastic Defend, path information can be found in the `dll.path` field.
+  - Examine the file creation and modification timestamps:
+    - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `dll.Ext.relative_file_name_modify_time` fields. The values are in seconds.
+    - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.
+      - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+  - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Use Osquery to investigate the drivers loaded into the system.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image,\nissuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image =\nauthenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image,\nissuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image =\nauthenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Related Rules*
+
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "windows" and process.pid == 4 and
+  (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
+  not dll.code_signature.status : ("errorExpired", "errorRevoked", "errorCode_endpoint:*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process.asciidoc
new file mode 100644
index 0000000000..a8da9da775
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process]]
+=== Unusual Child Process from a System Virtual Process
+
+Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Resources: Investigation Guide
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Unusual Child Process from a System Virtual Process*
+
+
+In Windows environments, the System process (PID 4) is a critical component responsible for managing system-level operations. Adversaries may exploit this by injecting malicious code to spawn unauthorized child processes, evading detection. The detection rule identifies anomalies by flagging unexpected child processes originating from the System process, excluding known legitimate executables, thus highlighting potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details of the suspicious child process, including the executable path and command line arguments, to determine if it matches known malicious patterns or anomalies.
+- Check the parent process (PID 4) to confirm it is indeed the System process and verify if any legitimate processes are excluded as per the rule (e.g., Registry, MemCompression, smss.exe).
+- Investigate the timeline of events leading up to the process start event to identify any preceding suspicious activities or anomalies that might indicate process injection or exploitation.
+- Correlate the alert with other security telemetry from data sources like Microsoft Defender for Endpoint or Sysmon to identify any related alerts or indicators of compromise.
+- Examine the network activity associated with the suspicious process to detect any unauthorized connections or data exfiltration attempts.
+- Consult threat intelligence sources to determine if the process executable or its behavior is associated with known malware or threat actor techniques.
+- If necessary, isolate the affected system to prevent further potential malicious activity and conduct a deeper forensic analysis.
+
+
+*False positive analysis*
+
+
+- Legitimate system maintenance tools may occasionally spawn child processes from the System process. Users should monitor and verify these tools and add them to the exclusion list if they are confirmed to be safe.
+- Some security software might create child processes from the System process as part of their normal operation. Identify these processes and configure exceptions to prevent unnecessary alerts.
+- Windows updates or system patches can sometimes trigger unexpected child processes. Ensure that these processes are part of a legitimate update cycle and exclude them if they are verified.
+- Custom scripts or administrative tools used for system management might also cause false positives. Review these scripts and tools, and if they are deemed safe, add them to the exclusion list.
+- Virtualization software or sandbox environments may mimic or interact with the System process in ways that trigger alerts. Validate these interactions and exclude them if they are part of normal operations.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further spread of the potential threat.
+- Terminate any suspicious child processes identified as originating from the System process (PID 4) that are not part of the known legitimate executables.
+- Conduct a thorough scan of the affected system using updated antivirus and anti-malware tools to identify and remove any injected malicious code.
+- Review recent system changes and installed software to identify any unauthorized modifications or installations that could have facilitated the process injection.
+- Restore the system from a known good backup if malicious activity is confirmed and cannot be fully remediated through other means.
+- Escalate the incident to the security operations team for further investigation and to determine if additional systems are affected.
+- Implement enhanced monitoring and logging for the affected system and similar environments to detect any recurrence of the threat, focusing on process creation events and anomalies related to the System process.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.pid == 4 and process.executable : "?*" and
+  not process.executable : ("Registry", "MemCompression", "?:\\Windows\\System32\\smss.exe", "HotPatch")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe.asciidoc
new file mode 100644
index 0000000000..144a4ee50c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe.asciidoc
@@ -0,0 +1,139 @@
+[[prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe]]
+=== Unusual Child Process of dns.exe
+
+Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://github.com/maxpl0it/CVE-2020-1350-DoS
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Child Process of dns.exe*
+
+
+SIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can effectively compromise the entire corporate infrastructure.
+
+This rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a similar remote code execution vulnerability in the DNS server.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes.
+  - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).
+  - Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: `mshta.exe`, `powershell.exe`, `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `wmic.exe`.
+  - If a denial-of-service (DoS) exploit is successful and DNS Server service crashes, be mindful of potential child processes related to `werfault.exe` occurring.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the host during the past 48 hours.
+- Check whether the server is vulnerable to CVE-2020-1350.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system or restore the compromised server to a clean state.
+- Install the latest patches on systems that run Microsoft DNS Server.
+- Consider the implementation of a patch management system, such as the Windows Server Update Services (WSUS).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "dns.exe" and
+  not process.executable : (
+    "?:\\Windows\\System32\\conhost.exe",
+
+    /* Crowdstrike specific exclusion as it uses NT Object paths */
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\conhost.exe",
+    "\\Device\\HarddiskVolume*\\Program Files\\ReasonLabs\\*"
+  ) and
+  not ?process.parent.executable : "?:\\Program Files\\ReasonLabs\\DNS\\ui\\DNS.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent.asciidoc
new file mode 100644
index 0000000000..3cfd1bb0e1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent.asciidoc
@@ -0,0 +1,238 @@
+[[prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent]]
+=== Unusual Command Execution from Web Server Parent
+
+This rule detects potential command execution from a web server parent process on a Linux host. Adversaries may attempt to execute commands from a web server parent process to blend in with normal web server activity and evade detection. This behavior is commonly observed in web shell attacks where adversaries exploit web server vulnerabilities to execute arbitrary commands on the host. The detection rule identifies unusual command execution from web server parent processes, which may indicate a compromised host or an ongoing attack. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Unusual Command Execution from Web Server Parent*
+
+
+Web servers, such as Apache or Nginx, are crucial for hosting web applications, often running on Linux systems. Adversaries exploit vulnerabilities in these servers to execute arbitrary commands, typically through web shells, blending malicious activity with legitimate server processes. The detection rule identifies suspicious command executions originating from web server processes, focusing on unusual patterns and contexts, such as unexpected working directories or command structures, to flag potential compromises.
+
+
+*Possible investigation steps*
+
+
+- Review the process.command_line field to understand the specific command executed and assess its legitimacy or potential malicious intent.
+- Examine the process.working_directory to determine if the command was executed from an unusual or suspicious directory, which could indicate a compromise.
+- Check the process.parent.executable and process.parent.name fields to identify the parent process and verify if it is a known web server or related service that could be exploited.
+- Investigate the user.name and user.id fields to confirm if the command was executed by a legitimate user or service account, or if it was potentially executed by an unauthorized user.
+- Correlate the @timestamp with other logs and events to identify any related activities or anomalies occurring around the same time, which could provide additional context or evidence of an attack.
+- Assess the agent.id to determine if the alert is isolated to a single host or if similar activities are observed across multiple hosts, indicating a broader issue.
+
+
+*False positive analysis*
+
+
+- Web development or testing environments may frequently execute commands from web server processes. To handle this, exclude specific working directories like /var/www/dev or /var/www/test from the rule.
+- Automated scripts or cron jobs running under web server user accounts can trigger alerts. Identify these scripts and add exceptions for their specific command lines or user IDs.
+- Legitimate administrative tasks performed by web server administrators might appear suspicious. Document these tasks and exclude their associated command lines or parent executables.
+- Continuous integration or deployment processes that involve web server interactions can be mistaken for threats. Exclude known CI/CD tool command lines or working directories from the rule.
+- Monitoring or logging tools that interact with web server processes may generate false positives. Identify these tools and exclude their specific process names or parent executables.
+
+
+*Response and remediation*
+
+
+- Isolate the affected host immediately to prevent further malicious activity and lateral movement within the network. This can be done by removing the host from the network or applying network segmentation.
+
+- Terminate any suspicious processes identified by the detection rule, especially those originating from web server parent processes executing shell commands. Use process IDs and command lines from the alert to target specific processes.
+
+- Conduct a thorough review of the web server logs and application logs to identify any unauthorized access or modifications. Look for patterns that match the command execution detected and any other anomalies.
+
+- Patch the web server and any associated applications to address known vulnerabilities that may have been exploited. Ensure that all software is up to date with the latest security patches.
+
+- Restore the affected system from a known good backup if any unauthorized changes or persistent threats are detected. Ensure that the backup is free from compromise before restoration.
+
+- Implement additional monitoring and alerting for similar activities, focusing on unusual command executions and web server behavior. Enhance logging and alerting to capture more detailed information about process executions and network connections.
+
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the attack is part of a larger campaign. Provide them with all relevant data and findings from the initial containment and remediation steps.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.process-*
+| keep
+    @timestamp,
+    host.os.type,
+    event.type,
+    event.action,
+    process.parent.name,
+    user.name,
+    user.id,
+    process.working_directory,
+    process.name,
+    process.command_line,
+    process.parent.executable,
+    agent.id,
+    host.name
+| where
+    @timestamp > now() - 1 hours and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "exec" and (
+      (
+        process.parent.name in (
+            "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
+            "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
+            "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
+        ) or
+        user.name in (
+            "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
+        ) or
+        user.id in ("99", "33", "498", "48") or
+        process.working_directory like "/var/www/*"
+      ) or
+      (
+        (
+          process.parent.name like "php-*" or
+          process.parent.name like "python*" or
+          process.parent.name like "ruby*" or
+          process.parent.name like "perl*"
+        ) and (
+          process.working_directory like "/var/www/*" or
+          process.working_directory like "/srv/www/*" or
+          process.working_directory like "/usr/share/nginx/*"
+        )
+      )
+    ) and
+    process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
+    process.command_line like "* -c *" and not (
+        process.working_directory like "/home/*" or
+        process.working_directory == "/" or
+        process.working_directory like "/vscode/vscode-server/*" or
+        process.parent.executable like "/vscode/vscode-server/*" or
+        process.parent.executable == "/usr/bin/xfce4-terminal"
+    )
+| stats
+    Esql.event_count = count(),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+  by process.command_line, process.working_directory, process.parent.executable
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.event_count < 5
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file.asciidoc
new file mode 100644
index 0000000000..0f72ccfefe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file]]
+=== Unusual Execution via Microsoft Common Console File
+
+Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.genians.co.kr/blog/threat_intelligence/facebook
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: SentinelOne
+
+*Version*: 205
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Execution via Microsoft Common Console File*
+
+
+- Investigate the source of the MSC file.
+- Investigate the process execution chain (all spawned child processes and their descendants).
+- Investigate the process and it's descendants network and file events.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+
+
+*Response and remediation*
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and endswith~(process.parent.args, ".msc") and
+  not (
+    process.parent.args : (
+      "?:\\Windows\\System32\\*.msc",
+      "?:\\Windows\\SysWOW64\\*.msc",
+      "?:\\Program files\\*.msc",
+      "?:\\Program Files (x86)\\*.msc"
+    ) or
+    (
+      process.executable : "?:\\Windows\\System32\\mmc.exe" and
+      process.command_line : "\"C:\\WINDOWS\\system32\\mmc.exe\" \"C:\\Windows\\System32\\gpme.msc\" /s /gpobject:\"LDAP://*"
+    ) or
+    (
+      process.executable : (
+        "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+        "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+        "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "?:\\Program Files\\internet explorer\\iexplore.exe"
+      ) and
+      process.args : "http*://go.microsoft.com/fwlink/*"
+    ) or
+    process.executable : (
+      "?:\\Windows\\System32\\vmconnect.exe",
+      "?:\\Windows\\System32\\WerFault.exe",
+      "?:\\Windows\\System32\\wermgr.exe"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe.asciidoc
new file mode 100644
index 0000000000..d2563d2264
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe.asciidoc
@@ -0,0 +1,71 @@
+[[prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe]]
+=== Unusual File Operation by dns.exe
+
+Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category : "file" and host.os.type : "windows" and
+  event.type : ("creation" or "deletion" or "change") and process.name : "dns.exe" and
+  not file.extension : ("old" or "temp" or "bak" or "dns" or "arpa" or "log")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched.asciidoc
new file mode 100644
index 0000000000..575e096c7d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched.asciidoc
@@ -0,0 +1,162 @@
+[[prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched]]
+=== Unusual File Transfer Utility Launched
+
+This rule leverages ESQL to detect the execution of unusual file transfer utilities on Linux systems. Attackers may use these utilities to exfiltrate data from a compromised system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Unusual File Transfer Utility Launched*
+
+
+File transfer utilities like scp, ftp, and rsync are essential for data movement in Linux environments. However, adversaries can exploit these tools to exfiltrate sensitive data. The detection rule identifies suspicious executions of these utilities by monitoring process activities, focusing on rare occurrences and unique agent IDs, which may indicate unauthorized data transfers. This helps in early detection of potential data breaches.
+
+
+*Possible investigation steps*
+
+
+- Review the process.command_line field to understand the exact command executed and assess if it aligns with typical usage patterns or if it appears suspicious.
+- Examine the process.parent.executable field to determine the parent process that initiated the file transfer utility, which may provide insights into whether the execution was part of a legitimate workflow or potentially malicious activity.
+- Check the agent.id field to identify the specific host involved in the alert and correlate it with other security events or logs from the same host to gather additional context.
+- Investigate the @timestamp field to verify the timing of the event and cross-reference with any known scheduled tasks or user activities that could explain the execution.
+- Analyze the host.os.type field to confirm the operating system and ensure that the alert pertains to a Linux environment, as expected by the rule.
+
+
+*False positive analysis*
+
+
+- Routine administrative tasks using file transfer utilities may trigger alerts. Regularly scheduled backups or updates using scp, rsync, or ftp should be documented and excluded from alerts by creating exceptions for known scripts or cron jobs.
+- Automated system updates or patches that utilize these utilities can be mistaken for suspicious activity. Identify and whitelist the processes and command lines associated with these updates to prevent false positives.
+- Internal data transfers between trusted servers for legitimate business purposes might be flagged. Establish a list of trusted agent IDs and exclude them from the rule to avoid unnecessary alerts.
+- Development and testing environments often use these utilities for transferring test data. Ensure that these environments are recognized and excluded by specifying their hostnames or IP addresses in the rule configuration.
+- User-initiated file transfers for legitimate reasons, such as data analysis or reporting, can be misinterpreted. Educate users to notify the security team of such activities in advance, allowing for temporary exceptions to be made.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected Linux system from the network to prevent further data exfiltration and unauthorized access.
+- Terminate any suspicious file transfer processes identified by the alert, such as scp, ftp, or rsync, to halt ongoing data transfers.
+- Conduct a thorough review of the process command lines and parent executables to identify any malicious scripts or unauthorized software that initiated the file transfer.
+- Change credentials and access keys associated with the compromised system to prevent further unauthorized access.
+- Escalate the incident to the security operations team for a deeper forensic analysis to determine the extent of the breach and identify any additional compromised systems.
+- Implement network monitoring to detect any further attempts of unauthorized file transfers or suspicious activities from the affected system.
+- Update and enhance endpoint detection and response (EDR) solutions to improve detection capabilities for similar threats in the future.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from one of the following integrations:
+- Elastic Defend
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.process-*
+| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, agent.id, host.name
+| where
+    @timestamp > now() - 1 hours and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "exec" and
+    process.name in ("scp", "ftp", "sftp", "vsftpd", "sftp-server", "rsync")
+| stats
+    Esql.event_count = count(),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+  by process.executable, process.parent.executable
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.event_count < 5
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent.asciidoc
new file mode 100644
index 0000000000..131667319c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent.asciidoc
@@ -0,0 +1,255 @@
+[[prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent]]
+=== Unusual Process Spawned from Web Server Parent
+
+This rule detects unusual processes spawned from a web server parent process by identifying low frequency counts of process spawning activity. Unusual process spawning activity may indicate an attacker attempting to establish persistence, execute malicious commands, or establish command and control channels on the host system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
+
+*Rule type*: esql
+
+*Rule indices*: None
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 1h
+
+*Searches indices from*: now-61m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Unusual Process Spawned from Web Server Parent*
+
+
+Web servers like Apache, Nginx, and others are crucial for hosting applications and services. Adversaries exploit these servers by spawning unauthorized processes to maintain persistence or execute malicious commands. The detection rule identifies anomalies by monitoring low-frequency process spawns from web server parents, focusing on unusual user IDs, directories, and process counts, which may indicate potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process.executable and process.command_line fields to understand the nature of the process that was spawned and assess if it aligns with expected behavior for the web server environment.
+- Examine the process.working_directory to determine if the directory is a legitimate location for web server operations or if it appears suspicious, such as being outside typical web server directories.
+- Check the user.name and user.id fields to verify if the process was executed by a legitimate web server user or if it was initiated by an unexpected or unauthorized user account.
+- Investigate the process.parent.executable to confirm whether the parent process is a known and trusted web server executable or if it has been tampered with or replaced.
+- Correlate the event with other logs or alerts from the same agent.id to identify any additional suspicious activities or patterns that may indicate a broader compromise.
+- Assess the host.os.type to ensure the alert pertains to a Linux system, as specified in the query, and verify if there are any known vulnerabilities or misconfigurations on the host that could have been exploited.
+
+
+*False positive analysis*
+
+
+- Processes related to legitimate web server maintenance tasks may trigger alerts. Review scheduled tasks or cron jobs that align with the alert timing and consider excluding these specific processes if they are verified as non-threatening.
+- Development environments often spawn processes that mimic attack patterns. Identify and exclude processes originating from known development directories or executed by development user accounts.
+- Automated scripts or monitoring tools running under web server user accounts can be mistaken for malicious activity. Verify these scripts and add exceptions for their specific process names or working directories.
+- Frequent updates or deployments in web applications can lead to unusual process spawns. Document these activities and exclude related processes if they consistently match the alert criteria during known update windows.
+- Custom web server modules or plugins may execute processes that appear suspicious. Validate these modules and exclude their associated processes if they are part of normal operations.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected host from the network to prevent further malicious activity and potential lateral movement.
+- Terminate any suspicious processes identified by the alert that are not part of legitimate web server operations.
+- Conduct a thorough review of the process command lines and executables flagged by the alert to identify any malicious scripts or binaries. Remove or quarantine these files as necessary.
+- Check for unauthorized changes in web server configurations or files within the working directories flagged by the alert. Restore any altered files from a known good backup.
+- Review user accounts and permissions associated with the web server processes to ensure no unauthorized accounts or privilege escalations have occurred. Reset passwords and revoke unnecessary access.
+- Monitor network traffic from the affected host for any signs of command and control communication, and block any identified malicious IP addresses or domains.
+- Escalate the incident to the security operations center (SOC) or incident response team for further analysis and to determine if additional systems are compromised.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule requires data coming in from Elastic Defend.
+
+
+*Elastic Defend Integration Setup*
+
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+
+
+*The following steps should be executed in order to add the Elastic Defend integration on a Linux System:*
+
+- Go to the Kibana home page and click "Add integrations".
+- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
+- Click "Add Elastic Defend".
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- We suggest selecting "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can click the "Existing hosts" tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html[helper guide].
+- Click "Save and Continue".
+- To complete the integration, select "Add Elastic Agent to your hosts" and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[helper guide].
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+from logs-endpoint.events.process-*
+| keep
+    @timestamp,
+    host.os.type,
+    event.type,
+    event.action,
+    process.parent.name,
+    user.name,
+    user.id,
+    process.working_directory,
+    process.name,
+    process.executable,
+    process.command_line,
+    process.parent.executable,
+    agent.id,
+    host.name
+| where
+    @timestamp > now() - 1 hours and
+    host.os.type == "linux" and
+    event.type == "start" and
+    event.action == "exec" and (
+      (
+        process.parent.name in (
+            "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
+            "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
+            "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
+        ) or
+        user.name in (
+            "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
+        ) or
+        user.id in ("99", "33", "498", "48") or
+        process.working_directory like "/var/www/*"
+      ) or
+      (
+        (
+          process.parent.name like "php-*" or
+          process.parent.name like "python*" or
+          process.parent.name like "ruby*" or
+          process.parent.name like "perl*"
+        ) and (
+          process.working_directory like "/var/www/*" or
+          process.working_directory like "/srv/www/*" or
+          process.working_directory like "/usr/share/nginx/*"
+        )
+      )
+    ) and (
+        process.name in (
+          "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat", "openssl", "busybox",
+          "nc", "ncat", "netcat", "nc.openbsd", "nc.traditional", "nohup", "setsid", "mkfifo", "mknod",
+          "node", "socket"
+        ) or
+        process.name like "python*" or
+        process.name like "php*" or
+        process.name like "perl" or
+        process.name like "ruby*" or
+        process.name like "lua*" or
+        process.executable like "/tmp/*" or
+        process.executable like "/var/tmp/*" or
+        process.executable like "/dev/shm/*" or
+        process.executable like "/var/log/*" or
+        process.executable like "/sys/*" or
+        process.executable like "/media/*" or
+        process.executable like "/proc/*" or
+        process.executable like "/var/backups/*" or
+        process.executable like "/var/mail/*" or
+        process.executable like "/var/spool/*" or
+        process.executable like "/var/www/*" or
+        process.executable like "./*" or
+        process.name like ".*"
+    ) and    
+    not (
+        process.working_directory like "/home/*" or
+        process.working_directory == "/" or
+        process.working_directory like "/var/www/*.ch" or
+        process.parent.executable like "/vscode/vscode-server/*"
+    )
+| stats
+    Esql.event_count = count(),
+    Esql.agent_id_count_distinct = count_distinct(agent.id),
+    Esql.host_name_values = values(host.name),
+    Esql.agent_id_values = values(agent.id)
+  by process.executable, process.working_directory, process.parent.executable
+| where
+    Esql.agent_id_count_distinct == 1 and
+    Esql.event_count < 5
+| sort Esql.event_count asc
+| limit 100
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting.asciidoc
new file mode 100644
index 0000000000..357e20249f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting]]
+=== User account exposed to Kerberoasting
+
+Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.security*
+* logs-windows.forwarded*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.thehacker.recipes/ad/movement/access-controls/targeted-kerberoasting
+* https://www.qomplx.com/qomplx-knowledge-kerberoasting-attacks-explained/
+* https://www.thehacker.recipes/ad/movement/kerberos/kerberoast
+* https://attack.stealthbits.com/cracking-kerberos-tgs-tickets-using-kerberoasting
+* https://adsecurity.org/?p=280
+* https://github.com/OTRF/Set-AuditRule
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Resources: Investigation Guide
+* Use Case: Active Directory Monitoring
+* Data Source: Windows Security Event Logs
+
+*Version*: 218
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating User account exposed to Kerberoasting*
+
+
+Service Principal Names (SPNs) are names by which Kerberos clients uniquely identify service instances for Kerberos target computers.
+
+By default, only computer accounts have SPNs, which creates no significant risk, since machine accounts have a default domain policy that rotates their passwords every 30 days, and the password is composed of 120 random characters, making them invulnerable to Kerberoasting.
+
+A user account with an SPN assigned is considered a service account, and is accessible to the entire domain. If any user in the directory requests a ticket-granting service (TGS), the domain controller will encrypt it with the secret key of the account executing the service. An attacker can potentially perform a Kerberoasting attack with this information, as the human-defined password is likely to be less complex.
+
+For scenarios where SPNs cannot be avoided on user accounts, Microsoft provides the Group Managed Service Accounts (gMSA) feature, which ensures that account passwords are robust and changed regularly and automatically. More information can be found https://docs.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview[here].
+
+Attackers can also perform "Targeted Kerberoasting", which consists of adding fake SPNs to user accounts that they have write privileges to, making them potentially vulnerable to Kerberoasting.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate if the target account is a member of privileged groups (Domain Admins, Enterprise Admins, etc.).
+- Investigate if tickets have been requested for the target account.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- The use of user accounts as service accounts is a bad security practice and should not be allowed in the domain. The security team should map and monitor any potential benign true positive (B-TP), especially if the account is privileged. Domain Administrators that define this kind of setting can put the domain at risk as user accounts don't have the same security standards as computer accounts (which have long, complex, random passwords that change frequently), exposing them to credential cracking attacks (Kerberoasting, brute force, etc.).
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover User objects, so set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+As this specifies the servicePrincipalName Attribute GUID, it is expected to be low noise.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=Users,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights WriteProperty -InheritanceFlags Children -AttributeGUID f3a64788-5306-11d1-a9c5-0000f80367c1 -AuditFlags Success
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.code:5136 and winlog.event_data.OperationType:"%%14674" and
+  winlog.event_data.ObjectClass:"user" and
+  winlog.event_data.AttributeLDAPDisplayName:"servicePrincipalName"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
new file mode 100644
index 0000000000..1327c4eaa5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -0,0 +1,193 @@
+[[prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes]]
+=== Web Shell Detection: Script Process Child of Common Web Processes
+
+Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
+* https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Initial Access
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: SentinelOne
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: Crowdstrike
+
+*Version*: 420
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Web Shell Detection: Script Process Child of Common Web Processes*
+
+
+Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the web server.
+
+This rule detects a web server process spawning script and command-line interface programs, potentially indicating attackers executing commands using the web shell.
+
+
+*Possible investigation steps*
+
+
+- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any other spawned child processes.
+- Examine the command line to determine which commands or scripts were executed.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and process.args : * and
+  process.parent.name:("w3wp.exe" or "httpd.exe" or "nginx.exe" or "php.exe" or "php-cgi.exe" or "tomcat.exe") and
+  (
+    process.name : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe") or
+    process.name.caseless : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe")
+  ) and
+  not
+  (
+    process.command_line : (
+      "cmd.exe /c mode CON" or
+      "cmd.exe /s /c \"mode CON\"" or
+      "cmd.exe /c \"mode\"" or
+      "cmd.exe /s /c \"tput colors 2>&1\"" or
+      "cmd.exe /s /c \"stty 2> NUL\"" or
+      "cmd.exe /s /c \"stty 2>&1\"" or
+      "cmd.exe /c \"stty 2>&1\"" or
+      "cmd.exe /s /c \"ipconfig /all 2>&1\"" or
+      "cmd.exe /s /c \"echo '%os%'\"" or
+      *.\\install\\awk.exe*
+    ) or
+    process.args : (\(git or (*artisan* and *queue\:work*) or *rmdir* or "mode CON" or ver or ls or mode or dir)
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell.asciidoc
new file mode 100644
index 0000000000..88cfd4f780
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell.asciidoc
@@ -0,0 +1,165 @@
+[[prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell]]
+=== Windows Defender Exclusions Added via PowerShell
+
+Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf
+* https://www.elastic.co/security-labs/elastic-security-uncovers-blister-malware-campaign
+* https://www.elastic.co/security-labs/operation-bleeding-bear
+* https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 317
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Defender Exclusions Added via PowerShell*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/[examples] was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Examine the exclusion in order to determine the intent behind it.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- If the exclusion specifies a suspicious file or path, retrieve the file(s) and determine if malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives due to how often network administrators legitimately configure exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many legitimate reasons for exclusions, so it's important to gain context.
+
+
+*Related rules*
+
+
+- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
+- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Exclusion lists for antimalware capabilities should always be routinely monitored for review.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")) and
+  process.args : ("*Add-MpPreference*", "*Set-MpPreference*") and
+  process.args : ("*-Exclusion*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell.asciidoc
new file mode 100644
index 0000000000..d50e01a660
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell.asciidoc
@@ -0,0 +1,150 @@
+[[prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell]]
+=== Windows Firewall Disabled via PowerShell
+
+Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps
+* https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
+* http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
+* http://woshub.com/manage-windows-firewall-powershell/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 315
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Firewall Disabled via PowerShell*
+
+
+Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
+
+Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.
+
+This rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
+- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Re-enable the firewall with its desired configurations.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
+  ) and
+  process.args : "*Set-NetFirewallProfile*" and
+  process.args : "*-Enabled*" and process.args : "*False*" and
+  process.args : ("*-All*", "*Public*", "*Domain*", "*Private*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client.asciidoc
new file mode 100644
index 0000000000..aa1a60c22f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client.asciidoc
@@ -0,0 +1,157 @@
+[[prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client]]
+=== Windows Service Installed via an Unusual Client
+
+Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-system.security*
+* logs-windows.forwarded*
+* winlogbeat-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.x86matthew.com/view_post?id=create_svc_rpc
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4697
+* https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0100_windows_audit_security_system_extension.md
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Windows Security Event Logs
+* Resources: Investigation Guide
+
+*Version*: 217
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Windows Service Installed via an Unusual Client*
+
+
+Windows services are crucial for running background processes with elevated privileges. Adversaries exploit this by creating services to escalate privileges from administrator to SYSTEM. The detection rule identifies anomalies by flagging service installations initiated by atypical processes, excluding known legitimate services. This helps in spotting potential privilege escalation attempts by monitoring unusual client activity.
+
+
+*Possible investigation steps*
+
+
+- Review the event logs to identify the specific client process that initiated the service installation by examining the winlog.event_data.ClientProcessId and winlog.event_data.ParentProcessId fields.
+- Investigate the parent process associated with the unusual client process to determine if it is a known legitimate application or potentially malicious.
+- Check the winlog.event_data.ServiceFileName to verify the path and name of the service file, ensuring it is not a known legitimate service excluded in the query.
+- Analyze the timeline of events around the service installation to identify any preceding suspicious activities or related alerts that might indicate a broader attack.
+- Conduct a reputation check on the client process and service file using threat intelligence sources to assess if they are associated with known malicious activities.
+- Examine the system for any additional indicators of compromise, such as unexpected network connections or changes to critical system files, that may suggest privilege escalation or lateral movement attempts.
+
+
+*False positive analysis*
+
+
+- Legitimate software installations or updates may trigger the rule if they create services using unusual client processes. To manage this, identify and whitelist these processes in the detection rule to prevent unnecessary alerts.
+- System management tools like Veeam and PDQ Inventory are already excluded, but other similar tools might not be. Regularly review and update the exclusion list to include any additional legitimate tools used in your environment.
+- Custom scripts or administrative tools that create services for maintenance or monitoring purposes can also cause false positives. Document these scripts and consider adding them to the exclusion list if they are verified as safe.
+- Temporary or one-time service installations for troubleshooting or testing can be mistaken for threats. Ensure that such activities are logged and communicated to the security team to avoid confusion and unnecessary alerts.
+- Changes in system configurations or updates to existing software might alter the behavior of legitimate processes, causing them to be flagged. Regularly review and adjust the detection rule to accommodate these changes while maintaining security integrity.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further unauthorized access or lateral movement by the adversary.
+- Terminate the suspicious service and any associated processes identified by the alert to stop potential privilege escalation or malicious activity.
+- Conduct a thorough review of the service's configuration and associated files to identify any unauthorized changes or malicious code.
+- Restore any altered or compromised system files from a known good backup to ensure system integrity.
+- Change all administrator and SYSTEM account passwords on the affected system and any connected systems to prevent further unauthorized access.
+- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine the scope of the breach.
+- Implement additional monitoring and logging on the affected system and similar environments to detect any recurrence of the threat or related suspicious activities.
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Security System Extension' logging policy must be configured for (Success)
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+System >
+Audit Security System Extension (Success)
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+configuration where host.os.type == "windows" and
+  event.action == "service-installed" and
+  (winlog.event_data.ClientProcessId == "0" or winlog.event_data.ParentProcessId == "0") and
+  startswith~(user.domain, winlog.computer_name) and winlog.event_data.ServiceAccount == "LocalSystem" and 
+  not winlog.event_data.ServiceFileName : (
+    "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
+    "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
+    "%SystemRoot%\\system32\\Drivers\\Crowdstrike\\*-CsInstallerService.exe",
+    "\"%windir%\\AdminArsenal\\PDQInventory-Scanner\\service-1\\PDQInventory-Scanner-1.exe\" ",
+    "\"%windir%\\AdminArsenal\\PDQDeployRunner\\service-1\\PDQDeployRunner-1.exe\" ",
+    "\"%windir%\\AdminArsenal\\PDQInventoryWakeCommand\\service-1\\PDQInventoryWakeCommand-1.exe\" ",
+    "\"%SystemRoot%\\nsnetpush.exe\"",
+    "\"C:\\WINDOWS\\ccmsetup\\ccmsetup.exe\" /runservice /ignoreskipupgrade /config:MobileClient.tcf",
+    "\"?:\\SMS\\bin\\x64\\srvboot.exe\"",
+    "%SystemRoot%\\pbpsdeploy.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-appendix.asciidoc
new file mode 100644
index 0000000000..50f4a2496c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-appendix.asciidoc
@@ -0,0 +1,107 @@
+["appendix",role="exclude",id="prebuilt-rule-8-18-14-prebuilt-rules-8-18-14-appendix"]
+= Downloadable rule update v8.18.14
+
+This section lists all updates associated with version 8.18.14 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-ec2-route-table-created.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc[]
+include::prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc[]
+include::prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk.asciidoc[]
+include::prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc[]
+include::prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request.asciidoc[]
+include::prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user.asciidoc[]
+include::prebuilt-rule-8-18-14-m365-portal-login-atypical-travel.asciidoc[]
+include::prebuilt-rule-8-18-14-m365-portal-login-impossible-travel.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned.asciidoc[]
+include::prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications.asciidoc[]
+include::prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc[]
+include::prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp.asciidoc[]
+include::prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc[]
+include::prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc[]
+include::prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc[]
+include::prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt.asciidoc[]
+include::prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc[]
+include::prebuilt-rule-8-18-14-d-bus-service-created.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent.asciidoc[]
+include::prebuilt-rule-8-18-14-crowdstrike-external-alerts.asciidoc[]
+include::prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell.asciidoc[]
+include::prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities.asciidoc[]
+include::prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc[]
+include::prebuilt-rule-8-18-14-powershell-mailbox-collection-script.asciidoc[]
+include::prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z.asciidoc[]
+include::prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints.asciidoc[]
+include::prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services.asciidoc[]
+include::prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser.asciidoc[]
+include::prebuilt-rule-8-18-14-outlook-home-page-registry-modification.asciidoc[]
+include::prebuilt-rule-8-18-14-remote-file-download-via-powershell.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-credential-access-via-dcsync.asciidoc[]
+include::prebuilt-rule-8-18-14-lsass-memory-dump-handle-access.asciidoc[]
+include::prebuilt-rule-8-18-14-modification-of-wdigest-security-provider.asciidoc[]
+include::prebuilt-rule-8-18-14-powershell-kerberos-ticket-request.asciidoc[]
+include::prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting.asciidoc[]
+include::prebuilt-rule-8-18-14-clearing-windows-console-history.asciidoc[]
+include::prebuilt-rule-8-18-14-clearing-windows-event-logs.asciidoc[]
+include::prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell.asciidoc[]
+include::prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell.asciidoc[]
+include::prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution.asciidoc[]
+include::prebuilt-rule-8-18-14-iis-http-logging-disabled.asciidoc[]
+include::prebuilt-rule-8-18-14-system-file-ownership-change.asciidoc[]
+include::prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution.asciidoc[]
+include::prebuilt-rule-8-18-14-untrusted-driver-loaded.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes.asciidoc[]
+include::prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query.asciidoc[]
+include::prebuilt-rule-8-18-14-powershell-share-enumeration-script.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file.asciidoc[]
+include::prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names.asciidoc[]
+include::prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache.asciidoc[]
+include::prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc[]
+include::prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity.asciidoc[]
+include::prebuilt-rule-8-18-14-remote-execution-via-file-shares.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe.asciidoc[]
+include::prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe.asciidoc[]
+include::prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries.asciidoc[]
+include::prebuilt-rule-8-18-14-component-object-model-hijacking.asciidoc[]
+include::prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc[]
+include::prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes.asciidoc[]
+include::prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028.asciidoc[]
+include::prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable.asciidoc[]
+include::prebuilt-rule-8-18-14-bypass-uac-via-event-viewer.asciidoc[]
+include::prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-summary.asciidoc
new file mode 100644
index 0000000000..2730afbffc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-summary.asciidoc
@@ -0,0 +1,214 @@
+[[prebuilt-rule-8-18-14-prebuilt-rules-8-18-14-summary]]
+[role="xpack"]
+== Update v8.18.14
+
+This section lists all updates associated with version 8.18.14 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-18-14-powershell-script-with-windows-defender-tampering-capabilities, PowerShell Script with Windows Defender Tampering Capabilities>> | Identifies PowerShell scripts containing cmdlets and parameters that attackers can abuse to disable Windows Defender features. Attackers can tamper with antivirus to reduce the risk of detection when executing their payloads. | new | 107 
+
+|<<prebuilt-rule-8-18-14-aws-s3-unauthenticated-bucket-access-by-rare-source, AWS S3 Unauthenticated Bucket Access by Rare Source>> | Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify --no-sign-request in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a New Terms rule, which means it will trigger for each unique combination of the source.address and targeted bucket name that has not been seen making this API request. | update | 5 
+
+|<<prebuilt-rule-8-18-14-aws-dynamodb-scan-by-unusual-user, AWS DynamoDB Scan by Unusual User>> | Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time. | update | 4 
+
+|<<prebuilt-rule-8-18-14-aws-dynamodb-table-exported-to-s3, AWS DynamoDB Table Exported to S3>> | Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time. | update | 5 
+
+|<<prebuilt-rule-8-18-14-aws-sns-rare-protocol-subscription-by-user, AWS SNS Rare Protocol Subscription by User>> | Identifies when a use subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user. | update | 6 
+
+|<<prebuilt-rule-8-18-14-aws-access-token-used-from-multiple-addresses, AWS Access Token Used from Multiple Addresses>> | This rule identifies potentially suspicious activity by detecting instances where a single IAM user's temporary session token is accessed from multiple IP addresses within a short time frame. Such behavior may suggest that an adversary has compromised temporary credentials and is utilizing them from various locations. To enhance detection accuracy and minimize false positives, the rule incorporates criteria that evaluate unique IP addresses, user agents, cities, and networks. These additional checks help distinguish between legitimate distributed access patterns and potential credential misuse. Detected activities are classified into different types based on the combination of unique indicators, with each classification assigned a fidelity score reflecting the likelihood of malicious behavior. High fidelity scores are given to patterns most indicative of threats, such as multiple unique IPs, networks, cities, and user agents. Medium and low fidelity scores correspond to less severe patterns, enabling security teams to effectively prioritize alerts. | update | 103 
+
+|<<prebuilt-rule-8-18-14-aws-ssm-session-started-to-ec2-instance, AWS SSM Session Started to EC2 Instance>> | Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation. | update | 5 
+
+|<<prebuilt-rule-8-18-14-aws-ec2-instance-connect-ssh-public-key-uploaded, AWS EC2 Instance Connect SSH Public Key Uploaded>> | Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console. | update | 6 
+
+|<<prebuilt-rule-8-18-14-aws-sns-topic-message-publish-by-rare-user, AWS SNS Topic Message Publish by Rare User>> | Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role. | update | 4 
+
+|<<prebuilt-rule-8-18-14-aws-ec2-route-table-modified-or-deleted, AWS EC2 Route Table Modified or Deleted>> | Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role. | update | 211 
+
+|<<prebuilt-rule-8-18-14-aws-iam-create-user-via-assumed-role-on-ec2-instance, AWS IAM Create User via Assumed Role on EC2 Instance>> | Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions. | update | 5 
+
+|<<prebuilt-rule-8-18-14-aws-ec2-route-table-created, AWS EC2 Route Table Created>> | Identifies when an EC2 Route Table has been created. Route tables can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role. | update | 211 
+
+|<<prebuilt-rule-8-18-14-aws-iam-customer-managed-policy-attached-to-role-by-rare-user, AWS IAM Customer-Managed Policy Attached to Role by Rare User>> | Detects when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user. Customer-managed policies are policies created and controlled within an AWS account, granting specific permissions to roles or users when attached. This rule identifies potential privilege escalation by flagging cases where a customer-managed policy is attached to a role by an unexpected actor, which could signal unauthorized access or misuse. Attackers may attach policies to roles to expand permissions and elevate their privileges within the AWS environment. This is a New Terms rule that uses the "cloud.account.id", "user.name" and "target.entity.id" fields to check if the combination of the actor identity and target role name has not been seen before. | update | 6 
+
+|<<prebuilt-rule-8-18-14-aws-sns-topic-created-by-rare-user, AWS SNS Topic Created by Rare User>> | Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role. | update | 4 
+
+|<<prebuilt-rule-8-18-14-suspicious-email-access-by-first-party-application-via-microsoft-graph, Suspicious Email Access by First-Party Application via Microsoft Graph>> | Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days. | update | 2 
+
+|<<prebuilt-rule-8-18-14-entra-id-protection-risk-detection-sign-in-risk, Entra ID Protection - Risk Detection - Sign-in Risk>> | Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more. | update | 3 
+
+|<<prebuilt-rule-8-18-14-entra-id-protection-risk-detection-user-risk, Entra ID Protection - Risk Detection - User Risk>> | Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more. | update | 2 
+
+|<<prebuilt-rule-8-18-14-microsoft-entra-id-user-reported-suspicious-activity, Microsoft Entra ID User Reported Suspicious Activity>> | Identifies suspicious activity reported by users in Microsoft Entra ID where users have reported suspicious activity related to their accounts, which may indicate potential compromise or unauthorized access attempts. Reported suspicious activity typically occurs during the authentication process and may involve various authentication methods, such as password resets, account recovery, or multi-factor authentication challenges. Adversaries may attempt to exploit user accounts by leveraging social engineering techniques or other methods to gain unauthorized access to sensitive information or resources. | update | 2 
+
+|<<prebuilt-rule-8-18-14-microsoft-entra-id-illicit-consent-grant-via-registered-application, Microsoft Entra ID Illicit Consent Grant via Registered Application>> | Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user. | update | 217 
+
+|<<prebuilt-rule-8-18-14-multiple-microsoft-entra-id-protection-alerts-by-user-principal, Multiple Microsoft Entra ID Protection Alerts by User Principal>> | Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account. | update | 2 
+
+|<<prebuilt-rule-8-18-14-microsoft-graph-first-occurrence-of-client-request, Microsoft Graph First Occurrence of Client Request>> | This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user. | update | 3 
+
+|<<prebuilt-rule-8-18-14-entra-id-mfa-disabled-for-user, Entra ID MFA Disabled for User>> | Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account. | update | 109 
+
+|<<prebuilt-rule-8-18-14-m365-portal-login-atypical-travel, M365 Portal Login (Atypical Travel)>> | Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft 365 account from an unusual location or behind a VPN. | update | 7 
+
+|<<prebuilt-rule-8-18-14-m365-portal-login-impossible-travel, M365 Portal Login (Impossible Travel)>> | Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location. | update | 7 
+
+|<<prebuilt-rule-8-18-14-microsoft-365-oauth-phishing-via-visual-studio-code-client, Microsoft 365 OAuth Phishing via Visual Studio Code Client>> | Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. | update | 2 
+
+|<<prebuilt-rule-8-18-14-microsoft-365-illicit-consent-grant-via-registered-application, Microsoft 365 Illicit Consent Grant via Registered Application>> | Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user. | update | 4 
+
+|<<prebuilt-rule-8-18-14-microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> | In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator / Company Administrator is a role that enables users to have access to all administrative features in Entra ID and services that use Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Adversaries can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. | update | 211 
+
+|<<prebuilt-rule-8-18-14-multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy, Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy>> | Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. | update | 210 
+
+|<<prebuilt-rule-8-18-14-potential-okta-mfa-bombing-via-push-notifications, Potential Okta MFA Bombing via Push Notifications>> | Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. | update | 211 
+
+|<<prebuilt-rule-8-18-14-potentially-successful-okta-mfa-bombing-via-push-notifications, Potentially Successful Okta MFA Bombing via Push Notifications>> | Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. | update | 417 
+
+|<<prebuilt-rule-8-18-14-okta-sign-in-events-via-third-party-idp, Okta Sign-In Events via Third-Party IdP>> | Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP). | update | 210 
+
+|<<prebuilt-rule-8-18-14-mfa-deactivation-with-no-re-activation-for-okta-user-account, MFA Deactivation with no Re-Activation for Okta User Account>> | Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. | update | 417 
+
+|<<prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> | A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. | update | 114 
+
+|<<prebuilt-rule-8-18-14-machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score>> | A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. | update | 12 
+
+|<<prebuilt-rule-8-18-14-high-number-of-egress-network-connections-from-unusual-executable, High Number of Egress Network Connections from Unusual Executable>> | This rule detects a high number of egress network connections from an unusual executable on a Linux system. This could indicate a command and control (C2) communication attempt, a brute force attack via a malware infection, or other malicious activity. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-potential-port-scanning-activity-from-compromised-host, Potential Port Scanning Activity from Compromised Host>> | This rule detects potential port scanning activity from a compromised host. Port scanning is a common reconnaissance technique used by attackers to identify open ports and services on a target system. A compromised host may exhibit port scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable services, or prepare for further exploitation. This rule identifies potential port scanning activity by monitoring network connection attempts from a single host to a large number of ports within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-potential-subnet-scanning-activity-from-compromised-host, Potential Subnet Scanning Activity from Compromised Host>> | This rule detects potential subnet scanning activity from a compromised host. Subnet scanning is a common reconnaissance technique used by attackers to identify live hosts within a network range. A compromised host may exhibit subnet scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable hosts, or prepare for further exploitation. This rule identifies potential subnet scanning activity by monitoring network connection attempts from a single host to a large number of hosts within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-unusual-file-transfer-utility-launched, Unusual File Transfer Utility Launched>> | This rule leverages ESQL to detect the execution of unusual file transfer utilities on Linux systems. Attackers may use these utilities to exfiltrate data from a compromised system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-potential-malware-driven-ssh-brute-force-attempt, Potential Malware-Driven SSH Brute Force Attempt>> | This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-successful-ssh-authentication-from-unusual-ssh-public-key, Successful SSH Authentication from Unusual SSH Public Key>> | This rule leverages the new_terms rule type to detect successful SSH authentications via a public key that has not been seen in the last 10 days. Public key authentication is a secure method for authenticating users to a server. Monitoring unusual public key authentication events can help detect unauthorized access attempts or suspicious activity on the system. | update | 4 
+
+|<<prebuilt-rule-8-18-14-d-bus-service-created, D-Bus Service Created>> | This rule detects the creation of D-Bus service files on Linux systems. D-Bus is a message bus system that provides a way for applications to talk to one another. D-Bus services are defined in service files that are typically located in default directories. The rule looks for the creation of service files that are not associated with known package managers or system services. Attackers may create malicious D-Bus services to establish persistence or escalate privileges on a system. | update | 5 
+
+|<<prebuilt-rule-8-18-14-unusual-process-spawned-from-web-server-parent, Unusual Process Spawned from Web Server Parent>> | This rule detects unusual processes spawned from a web server parent process by identifying low frequency counts of process spawning activity. Unusual process spawning activity may indicate an attacker attempting to establish persistence, execute malicious commands, or establish command and control channels on the host system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-unusual-command-execution-from-web-server-parent, Unusual Command Execution from Web Server Parent>> | This rule detects potential command execution from a web server parent process on a Linux host. Adversaries may attempt to execute commands from a web server parent process to blend in with normal web server activity and evade detection. This behavior is commonly observed in web shell attacks where adversaries exploit web server vulnerabilities to execute arbitrary commands on the host. The detection rule identifies unusual command execution from web server parent processes, which may indicate a compromised host or an ongoing attack. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. | update | 6 
+
+|<<prebuilt-rule-8-18-14-crowdstrike-external-alerts, CrowdStrike External Alerts>> | Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app. | update | 2 
+
+|<<prebuilt-rule-8-18-14-exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 213 
+
+|<<prebuilt-rule-8-18-14-powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> | Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. | update | 215 
+
+|<<prebuilt-rule-8-18-14-powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> | Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. | update | 213 
+
+|<<prebuilt-rule-8-18-14-powershell-mailbox-collection-script, PowerShell Mailbox Collection Script>> | Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information. | update | 112 
+
+|<<prebuilt-rule-8-18-14-encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> | Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. | update | 217 
+
+|<<prebuilt-rule-8-18-14-connection-to-common-large-language-model-endpoints, Connection to Common Large Language Model Endpoints>> | Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way. | update | 2 
+
+|<<prebuilt-rule-8-18-14-connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> | Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. | update | 122 
+
+|<<prebuilt-rule-8-18-14-network-activity-to-a-suspicious-top-level-domain, Network Activity to a Suspicious Top Level Domain>> | Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executable running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names. | update | 2 
+
+|<<prebuilt-rule-8-18-14-potential-file-download-via-a-headless-browser, Potential File Download via a Headless Browser>> | Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries may use browsers to avoid ingress tool transfer restrictions. | update | 207 
+
+|<<prebuilt-rule-8-18-14-outlook-home-page-registry-modification, Outlook Home Page Registry Modification>> | Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence. | update | 207 
+
+|<<prebuilt-rule-8-18-14-remote-file-download-via-powershell, Remote File Download via PowerShell>> | Identifies powershell.exe being used to download an executable file from an untrusted remote destination. | update | 114 
+
+|<<prebuilt-rule-8-18-14-potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> | Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. | update | 319 
+
+|<<prebuilt-rule-8-18-14-potential-credential-access-via-dcsync, Potential Credential Access via DCSync>> | This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. | update | 220 
+
+|<<prebuilt-rule-8-18-14-lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> | Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. | update | 216 
+
+|<<prebuilt-rule-8-18-14-modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> | Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. | update | 214 
+
+|<<prebuilt-rule-8-18-14-powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> | Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. | update | 216 
+
+|<<prebuilt-rule-8-18-14-user-account-exposed-to-kerberoasting, User account exposed to Kerberoasting>> | Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting. | update | 218 
+
+|<<prebuilt-rule-8-18-14-clearing-windows-console-history, Clearing Windows Console History>> | Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. | update | 317 
+
+|<<prebuilt-rule-8-18-14-clearing-windows-event-logs, Clearing Windows Event Logs>> | Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. | update | 319 
+
+|<<prebuilt-rule-8-18-14-windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> | Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. | update | 317 
+
+|<<prebuilt-rule-8-18-14-disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> | Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. | update | 317 
+
+|<<prebuilt-rule-8-18-14-disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> | Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. | update | 318 
+
+|<<prebuilt-rule-8-18-14-potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> | Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. | update | 217 
+
+|<<prebuilt-rule-8-18-14-suspicious-microsoft-antimalware-service-execution, Suspicious Microsoft Antimalware Service Execution>> | Identifies suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances. This may indicate an attempt to evade defenses through DLL side-loading or by masquerading as the antimalware process. | update | 216 
+
+|<<prebuilt-rule-8-18-14-iis-http-logging-disabled, IIS HTTP Logging Disabled>> | Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. | update | 316 
+
+|<<prebuilt-rule-8-18-14-system-file-ownership-change, System File Ownership Change>> | Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files. | update | 2 
+
+|<<prebuilt-rule-8-18-14-windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> | Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. | update | 315 
+
+|<<prebuilt-rule-8-18-14-suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> | Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. | update | 215 
+
+|<<prebuilt-rule-8-18-14-untrusted-driver-loaded, Untrusted Driver Loaded>> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | update | 13 
+
+|<<prebuilt-rule-8-18-14-unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> | Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. | update | 317 
+
+|<<prebuilt-rule-8-18-14-suspicious-access-to-ldap-attributes, Suspicious Access to LDAP Attributes>> | Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information. | update | 107 
+
+|<<prebuilt-rule-8-18-14-system-public-ip-discovery-via-dns-query, System Public IP Discovery via DNS Query>> | Identifies DNS queries to known public IP address lookup web services. Malwares tend to perform this action to assess potential targets. | update | 2 
+
+|<<prebuilt-rule-8-18-14-powershell-share-enumeration-script, PowerShell Share Enumeration Script>> | Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. | update | 114 
+
+|<<prebuilt-rule-8-18-14-unusual-execution-via-microsoft-common-console-file, Unusual Execution via Microsoft Common Console File>> | Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands. | update | 205 
+
+|<<prebuilt-rule-8-18-14-deprecated-execution-of-file-written-or-modified-by-pdf-reader, Deprecated - Execution of File Written or Modified by PDF Reader>> | Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. | update | 211 
+
+|<<prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-author, Potential PowerShell HackTool Script by Author>> | Detects known PowerShell offensive tooling author's name in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code, which may still contain the author artifacts. This rule identifies common author handles found in popular PowerShell scripts used for red team exercises. | update | 108 
+
+|<<prebuilt-rule-8-18-14-potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> | Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. | update | 218 
+
+|<<prebuilt-rule-8-18-14-command-and-scripting-interpreter-via-windows-scripts, Command and Scripting Interpreter via Windows Scripts>> | Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe. | update | 207 
+
+|<<prebuilt-rule-8-18-14-microsoft-management-console-file-from-unusual-path, Microsoft Management Console File from Unusual Path>> | Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution. | update | 313 
+
+|<<prebuilt-rule-8-18-14-potential-ransomware-behavior-high-count-of-readme-files-by-system, Potential Ransomware Behavior - High count of Readme files by System>> | This rule identifies a high number (20) of file creation event by the System virtual process from the same host and with same file name containing keywords similar to ransomware note files and all within a short time period. | update | 210 
+
+|<<prebuilt-rule-8-18-14-potential-system-tampering-via-file-modification, Potential System Tampering via File Modification>> | Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior. | update | 2 
+
+|<<prebuilt-rule-8-18-14-suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> | Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. | update | 210 
+
+|<<prebuilt-rule-8-18-14-microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> | Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. | update | 313 
+
+|<<prebuilt-rule-8-18-14-screenconnect-server-spawning-suspicious-processes, ScreenConnect Server Spawning Suspicious Processes>> | Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor. | update | 208 
+
+|<<prebuilt-rule-8-18-14-potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> | Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. | update | 313 
+
+|<<prebuilt-rule-8-18-14-remote-execution-via-file-shares, Remote Execution via File Shares>> | Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. | update | 120 
+
+|<<prebuilt-rule-8-18-14-unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> | Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. | update | 317 
+
+|<<prebuilt-rule-8-18-14-unusual-file-operation-by-dns-exe, Unusual File Operation by dns.exe>> | Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. | update | 215 
+
+|<<prebuilt-rule-8-18-14-suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> | Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. | update | 318 
+
+|<<prebuilt-rule-8-18-14-potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> | Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. | update | 216 
+
+|<<prebuilt-rule-8-18-14-component-object-model-hijacking, Component Object Model Hijacking>> | Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. | update | 117 
+
+|<<prebuilt-rule-8-18-14-execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> | Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. | update | 317 
+
+|<<prebuilt-rule-8-18-14-web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> | Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. | update | 420 
+
+|<<prebuilt-rule-8-18-14-potential-privilege-escalation-via-cve-2022-38028, Potential privilege escalation via CVE-2022-38028>> | Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijack the print spooler service execution. | update | 208 
+
+|<<prebuilt-rule-8-18-14-privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> | Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. | update | 313 
+
+|<<prebuilt-rule-8-18-14-bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> | Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 321 
+
+|<<prebuilt-rule-8-18-14-windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> | Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. | update | 217 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 1a0b40a872..f769520d29 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
+|<<prebuilt-rule-8-18-14-prebuilt-rules-8-18-14-summary, 8.18.14>> | 18 Sep 2025 | 1 | 100 | 
+This release includes significant rule tuning for Windows, Linux, Okta and AWS rules for better rule efficacy and performance. 
+
+
 |<<prebuilt-rule-8-18-13-prebuilt-rules-8-18-13-summary, 8.18.13>> | 02 Sep 2025 | 20 | 112 | 
 This release includes new rules for Windows, Linux, Microsoft 365 and Network Traffic. New rules for Windows include detection for impact, credential access, execution, command and control, discovery and defense evasion. New rules for Linux include detection for defense evasion. New rules for Microsoft 365 and Network Traffic include detection for initial access. Additionally, significant rule tuning for Windows, AWS, Microsoft 365, MacOS and Azure rules has been added for better rule efficacy and performance.
 
@@ -79,3 +83,4 @@ include::downloadable-packages/8-18-10/prebuilt-rules-8-18-10-summary.asciidoc[l
 include::downloadable-packages/8-18-11/prebuilt-rules-8-18-11-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-18-12/prebuilt-rules-8-18-12-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-18-13/prebuilt-rules-8-18-13-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-18-14/prebuilt-rules-8-18-14-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 444d6d03e3..2632d28f69 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -18,7 +18,7 @@ and their rule type is `machine_learning`.
 
 |<<apt-package-manager-configuration-file-creation, APT Package Manager Configuration File Creation>> |Detects file creation events in the configuration directory for the APT package manager. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on (by default) Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |7
 
-|<<aws-access-token-used-from-multiple-addresses, AWS Access Token Used from Multiple Addresses>> |This rule identifies potentially suspicious activity by detecting instances where a single IAM user's temporary session token is accessed from multiple IP addresses within a short time frame. Such behavior may suggest that an adversary has compromised temporary credentials and is utilizing them from various locations. To enhance detection accuracy and minimize false positives, the rule incorporates criteria that evaluate unique IP addresses, user agents, cities, and networks. These additional checks help distinguish between legitimate distributed access patterns and potential credential misuse. Detected activities are classified into different types based on the combination of unique indicators, with each classification assigned a fidelity score reflecting the likelihood of malicious behavior. High fidelity scores are given to patterns most indicative of threats, such as multiple unique IPs, networks, cities, and user agents. Medium and low fidelity scores correspond to less severe patterns, enabling security teams to effectively prioritize alerts. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Data Source: AWS CloudTrail], [Tactic: Initial Access], [Use Case: Identity and Access Audit], [Resources: Investigation Guide] |None |102
+|<<aws-access-token-used-from-multiple-addresses, AWS Access Token Used from Multiple Addresses>> |This rule identifies potentially suspicious activity by detecting instances where a single IAM user's temporary session token is accessed from multiple IP addresses within a short time frame. Such behavior may suggest that an adversary has compromised temporary credentials and is utilizing them from various locations. To enhance detection accuracy and minimize false positives, the rule incorporates criteria that evaluate unique IP addresses, user agents, cities, and networks. These additional checks help distinguish between legitimate distributed access patterns and potential credential misuse. Detected activities are classified into different types based on the combination of unique indicators, with each classification assigned a fidelity score reflecting the likelihood of malicious behavior. High fidelity scores are given to patterns most indicative of threats, such as multiple unique IPs, networks, cities, and user agents. Medium and low fidelity scores correspond to less severe patterns, enabling security teams to effectively prioritize alerts. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Data Source: AWS CloudTrail], [Tactic: Initial Access], [Use Case: Identity and Access Audit], [Resources: Investigation Guide] |None |103
 
 |<<aws-bedrock-detected-multiple-attempts-to-use-denied-models-by-a-single-user, AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User>> |Identifies multiple successive failed attempts to use denied model resources within AWS Bedrock. This could indicated attempts to bypass limitations of other approved models, or to force an impact on the environment by incurring exhorbitant costs. |[Domain: LLM], [Data Source: AWS Bedrock], [Data Source: AWS S3], [Resources: Investigation Guide], [Use Case: Policy Violation], [Mitre Atlas: T0015], [Mitre Atlas: T0034] |None |5
 
@@ -60,9 +60,9 @@ and their rule type is `machine_learning`.
 
 |<<aws-discovery-api-calls-via-cli-from-a-single-resource, AWS Discovery API Calls via CLI from a Single Resource>> |Detects when a single AWS resource is running multiple `Describe` and `List` API calls in a 10-second window. This behavior could indicate an actor attempting to discover the AWS infrastructure using compromised credentials or a compromised instance. Adversaries may use this information to identify potential targets for further exploitation or to gain a better understanding of the target's infrastructure. |[Domain: Cloud], [Data Source: AWS], [Data Source: AWS EC2], [Data Source: AWS IAM], [Data Source: AWS S3], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |None |3
 
-|<<aws-dynamodb-scan-by-unusual-user, AWS DynamoDB Scan by Unusual User>> |Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by the `aws.cloudtrail.user_identity.arn` for the first time in the last 14 days. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS DynamoDB], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |3
+|<<aws-dynamodb-scan-by-unusual-user, AWS DynamoDB Scan by Unusual User>> |Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS DynamoDB], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |4
 
-|<<aws-dynamodb-table-exported-to-s3, AWS DynamoDB Table Exported to S3>> |Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by the "user.name" for the first time. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS DynamoDB], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |4
+|<<aws-dynamodb-table-exported-to-s3, AWS DynamoDB Table Exported to S3>> |Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS DynamoDB], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |5
 
 |<<aws-ec2-ami-shared-with-another-account, AWS EC2 AMI Shared with Another Account>> |Identifies an AWS Amazon Machine Image (AMI) being shared with another AWS account. Adversaries with access may share an AMI with an external AWS account as a means of data exfiltration. AMIs can contain secrets, bash histories, code artifacts, and other sensitive data that adversaries may abuse if shared with unauthorized accounts. AMIs can be made publicly available accidentally as well. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Threat Detection], [Tactic: Exfiltration], [Resources: Investigation Guide] |None |6
 
@@ -76,7 +76,7 @@ and their rule type is `machine_learning`.
 
 |<<aws-ec2-full-network-packet-capture-detected, AWS EC2 Full Network Packet Capture Detected>> |Identifies potential Traffic Mirroring in an Amazon Elastic Compute Cloud (EC2) instance. Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an Elastic network interface. This feature can potentially be abused to exfiltrate sensitive data from unencrypted internal traffic. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Network Security Monitoring], [Tactic: Exfiltration], [Tactic: Collection], [Resources: Investigation Guide] |None |209
 
-|<<aws-ec2-instance-connect-ssh-public-key-uploaded, AWS EC2 Instance Connect SSH Public Key Uploaded>> |Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule also detects the `SendSerialConsoleSSHPublicKey` or `SendSSHPublicKey` API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation], [Tactic: Lateral Movement], [Resources: Investigation Guide] |None |5
+|<<aws-ec2-instance-connect-ssh-public-key-uploaded, AWS EC2 Instance Connect SSH Public Key Uploaded>> |Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation], [Tactic: Lateral Movement], [Resources: Investigation Guide] |None |6
 
 |<<aws-ec2-instance-console-login-via-assumed-role, AWS EC2 Instance Console Login via Assumed Role>> |Identifies a successful console login activity by an EC2 instance profile using an assumed role. This is uncommon behavior and could indicate an attacker using compromised credentials to further exploit an environment. An EC2 instance assumes a role using their EC2 ID as the session name. This rule looks for the pattern "i-" which is the beginning pattern for assumed role sessions started by an EC2 instance and a successful `ConsoleLogin` or `GetSigninToken` API call. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Data Source: AWS STS], [Use Case: Identity and Access Audit], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide] |None |4
 
@@ -88,7 +88,9 @@ and their rule type is `machine_learning`.
 
 |<<aws-ec2-network-access-control-list-deletion, AWS EC2 Network Access Control List Deletion>> |Identifies the deletion of an Amazon Elastic Compute Cloud (EC2) network access control list (ACL) or one of its ingress/egress entries. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Network Security Monitoring], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |210
 
-|<<aws-ec2-route-table-modified-or-deleted, AWS EC2 Route Table Modified or Deleted>> |Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that detects the first instance of this behavior by the `aws.cloudtrail.user_identity.arn` field in the last 10 days. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Network Security Monitoring], [Resources: Investigation Guide], [Tactic: Persistence] |None |210
+|<<aws-ec2-route-table-created, AWS EC2 Route Table Created>> |Identifies when an EC2 Route Table has been created. Route tables can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Network Security Monitoring], [Tactic: Persistence], [Resources: Investigation Guide] |None |211
+
+|<<aws-ec2-route-table-modified-or-deleted, AWS EC2 Route Table Modified or Deleted>> |Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Network Security Monitoring], [Resources: Investigation Guide], [Tactic: Persistence] |None |211
 
 |<<aws-ec2-security-group-configuration-change, AWS EC2 Security Group Configuration Change>> |Identifies a change to an AWS Security Group Configuration. A security group is like a virtual firewall, and modifying configurations may allow unauthorized access. Threat actors may abuse this to establish persistence, exfiltrate data, or pivot in an AWS environment. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS EC2], [Use Case: Network Security Monitoring], [Resources: Investigation Guide], [Tactic: Persistence], [Tactic: Defense Evasion] |None |211
 
@@ -118,15 +120,15 @@ and their rule type is `machine_learning`.
 
 |<<aws-iam-administratoraccess-policy-attached-to-user, AWS IAM AdministratorAccess Policy Attached to User>> |An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by attaching additional permissions to compromised user accounts. This rule looks for use of the IAM `AttachUserPolicy` API operation to attach the highly permissive `AdministratorAccess` AWS managed policy to an existing IAM user. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation], [Tactic: Persistence], [Resources: Investigation Guide] |None |7
 
-|<<aws-iam-assume-role-policy-update, AWS IAM Assume Role Policy Update>> |Identifies AWS CloudTrail events where an IAM role's trust policy has been updated by an IAM user or Assumed Role identity. The trust policy is a JSON document that defines which principals are allowed to assume the role. An attacker may attempt to modify this policy to gain the privileges of the role. This is a New Terms rule, which means it will only trigger once for each unique combination of the "cloud.account.id", "user.name" and "target.entity.id" fields, that have not been seen making this API request. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Privilege Escalation] |8.16.5 |214
+|<<aws-iam-assume-role-policy-update, AWS IAM Assume Role Policy Update>> |Identifies AWS CloudTrail events where an IAM role's trust policy has been updated by an IAM user or Assumed Role identity. The trust policy is a JSON document that defines which principals are allowed to assume the role. An attacker may attempt to modify this policy to gain the privileges of the role. This is a New Terms rule, which means it will only trigger once for each unique combination of the "cloud.account.id", "user.name" and "target.entity.id" fields, that have not been seen making this API request. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Privilege Escalation] |None |214
 
 |<<aws-iam-brute-force-of-assume-role-policy, AWS IAM Brute Force of Assume Role Policy>> |Identifies a high number of failed attempts to assume an AWS Identity and Access Management (IAM) role. IAM roles are used to delegate access to users or services. An adversary may attempt to enumerate IAM roles in order to determine if a role exists before attempting to assume or hijack the discovered role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Credential Access] |None |212
 
 |<<aws-iam-compromisedkeyquarantine-policy-attached-to-user, AWS IAM CompromisedKeyQuarantine Policy Attached to User>> |This rule looks for use of the IAM `AttachUserPolicy` API operation to attach the `CompromisedKeyQuarantine` or `CompromisedKeyQuarantineV2` AWS managed policies to an existing IAM user. This policy denies access to certain actions and is applied by the AWS team in the event that an IAM user's credentials have been compromised or exposed publicly. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |None |4
 
-|<<aws-iam-create-user-via-assumed-role-on-ec2-instance, AWS IAM Create User via Assumed Role on EC2 Instance>> |Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles—particularly from within EC2 instances—may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |4
+|<<aws-iam-create-user-via-assumed-role-on-ec2-instance, AWS IAM Create User via Assumed Role on EC2 Instance>> |Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |5
 
-|<<aws-iam-customer-managed-policy-attached-to-role-by-rare-user, AWS IAM Customer-Managed Policy Attached to Role by Rare User>> |Detects when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user. Customer-managed policies are policies created and controlled within an AWS account, granting specific permissions to roles or users when attached. This rule identifies potential privilege escalation by flagging cases where a customer-managed policy is attached to a role by an unexpected actor, which could signal unauthorized access or misuse. Attackers may attach policies to roles to expand permissions and elevate their privileges within the AWS environment. This is a New Terms rule that uses the "cloud.account.id", "user.name" and "target.entity.id" fields to check if the combination of the actor identity and target role name has not been seen before. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.16.5 |5
+|<<aws-iam-customer-managed-policy-attached-to-role-by-rare-user, AWS IAM Customer-Managed Policy Attached to Role by Rare User>> |Detects when an AWS Identity and Access Management (IAM) customer-managed policy is attached to a role by an unusual or unauthorized user. Customer-managed policies are policies created and controlled within an AWS account, granting specific permissions to roles or users when attached. This rule identifies potential privilege escalation by flagging cases where a customer-managed policy is attached to a role by an unexpected actor, which could signal unauthorized access or misuse. Attackers may attach policies to roles to expand permissions and elevate their privileges within the AWS environment. This is a New Terms rule that uses the "cloud.account.id", "user.name" and "target.entity.id" fields to check if the combination of the actor identity and target role name has not been seen before. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |None |6
 
 |<<aws-iam-deactivation-of-mfa-device, AWS IAM Deactivation of MFA Device>> |Identifies the deactivation of a specified multi-factor authentication (MFA) device and removes it from association with the user name for which it was originally enabled. In AWS Identity and Access Management (IAM), a device must be deactivated before it can be deleted. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS IAM], [Resources: Investigation Guide], [Tactic: Impact], [Tactic: Persistence] |None |212
 
@@ -198,8 +200,6 @@ and their rule type is `machine_learning`.
 
 |<<aws-route-53-domain-transferred-to-another-account, AWS Route 53 Domain Transferred to Another Account>> |Identifies when a request has been made to transfer a Route 53 domain to another AWS account. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS Route53], [Use Case: Asset Visibility], [Tactic: Persistence], [Resources: Investigation Guide] |None |209
 
-|<<aws-route-table-created, AWS Route Table Created>> |Identifies when an AWS Route Table has been created. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS Route53], [Use Case: Network Security Monitoring], [Tactic: Persistence], [Resources: Investigation Guide] |None |210
-
 |<<aws-route53-private-hosted-zone-associated-with-a-vpc, AWS Route53 private hosted zone associated with a VPC>> |Identifies when a Route53 private hosted zone has been associated with VPC. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS Route53], [Use Case: Asset Visibility], [Tactic: Persistence], [Resources: Investigation Guide] |None |209
 
 |<<aws-s3-bucket-configuration-deletion, AWS S3 Bucket Configuration Deletion>> |Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Use Case: Asset Visibility], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |210
@@ -220,16 +220,20 @@ and their rule type is `machine_learning`.
 
 |<<aws-s3-static-site-javascript-file-uploaded, AWS S3 Static Site JavaScript File Uploaded>> |This rule detects when a JavaScript file is uploaded or accessed in an S3 static site directory (`static/js/`) by an IAM user or assumed role. This can indicate suspicious modification of web content hosted on S3, such as injecting malicious scripts into a static website frontend. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS S3], [Tactic: Impact], [Use Case: Web Application Compromise], [Use Case: Cloud Threat Detection], [Resources: Investigation Guide] |None |2
 
-|<<aws-s3-unauthenticated-bucket-access-by-rare-source, AWS S3 Unauthenticated Bucket Access by Rare Source>> |Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify `--no-sign-request` in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule, which means it will only trigger once for each unique value of the `source.address` field that has not been seen making this API request within the last 7 days. This field contains the IP address of the source making the request. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: Amazon S3], [Use Case: Asset Visibility], [Resources: Investigation Guide], [Tactic: Collection] |None |4
+|<<aws-s3-unauthenticated-bucket-access-by-rare-source, AWS S3 Unauthenticated Bucket Access by Rare Source>> |Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify --no-sign-request in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a New Terms rule, which means it will trigger for each unique combination of the source.address and targeted bucket name that has not been seen making this API request. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: Amazon S3], [Use Case: Asset Visibility], [Resources: Investigation Guide], [Tactic: Collection] |None |5
+
+|<<aws-sns-rare-protocol-subscription-by-user, AWS SNS Rare Protocol Subscription by User>> |Identifies when a use subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration], [Tactic: Collection], [Tactic: Impact] |None |6
 
-|<<aws-sns-email-subscription-by-rare-user, AWS SNS Email Subscription by Rare User>> |Identifies when an SNS topic is subscribed to by an email address of a user who does not typically perform this action. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Exfiltration] |None |5
+|<<aws-sns-topic-created-by-rare-user, AWS SNS Topic Created by Rare User>> |Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Resource Development], [Tactic: Impact] |None |4
 
-|<<aws-sns-topic-created-by-rare-user, AWS SNS Topic Created by Rare User>> |Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Resource Development] |None |3
+|<<aws-sns-topic-message-publish-by-rare-user, AWS SNS Topic Message Publish by Rare User>> |Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Lateral Movement], [Tactic: Exfiltration], [Tactic: Impact] |None |4
 
 |<<aws-sqs-queue-purge, AWS SQS Queue Purge>> |Identifies when an AWS Simple Queue Service (SQS) queue is purged. Adversaries may purge SQS queues to disrupt operations, delete messages, or impair monitoring and alerting mechanisms. This action can be used to evade detection and cover tracks by removing evidence of malicious activities. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SQS], [Use Case: Threat Detection], [Use Case: Log Auditing], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |4
 
 |<<aws-ssm-command-document-created-by-rare-user, AWS SSM Command Document Created by Rare User>> |Identifies when an AWS Systems Manager (SSM) command document is created by a user or role who does not typically perform this action. Adversaries may create SSM command documents to execute commands on managed instances, potentially leading to unauthorized access, command and control, data exfiltration and more. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SSM], [Data Source: AWS Systems Manager], [Resources: Investigation Guide], [Use Case: Threat Detection], [Tactic: Execution] |None |5
 
+|<<aws-ssm-session-started-to-ec2-instance, AWS SSM Session Started to EC2 Instance>> |Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SSM], [Data Source: AWS EC2], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |None |5
+
 |<<aws-ssm-sendcommand-execution-by-rare-user, AWS SSM `SendCommand` Execution by Rare User>> |Detects the execution of commands or scripts on EC2 instances using AWS Systems Manager (SSM), such as RunShellScript, RunPowerShellScript or custom documents. While legitimate users may employ these commands for management tasks, they can also be exploited by attackers with credentials to establish persistence, install malware, or execute reverse shells for further access to compromised instances. This is a New Terms rule that looks for the first instance of this behavior by a user or role. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SSM], [Data Source: AWS Systems Manager], [Use Case: Log Auditing], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide] |None |215
 
 |<<aws-ssm-sendcommand-with-run-shell-command-parameters, AWS SSM `SendCommand` with Run Shell Command Parameters>> |Identifies the use of the AWS Systems Manager (SSM) `SendCommand` API with the either `AWS-RunShellScript` or `AWS-RunPowerShellScript` parameters. The `SendCommand` API call allows users to execute commands on EC2 instances using the SSM service. Adversaries may use this technique to execute commands on EC2 instances without the need for SSH or RDP access. This behavior may indicate an adversary attempting to execute commands on an EC2 instance for malicious purposes. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time on a host in the last 7 days. |[Domain: Endpoint], [Domain: Cloud], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager], [Resources: Investigation Guide] |None |6
@@ -482,15 +486,15 @@ and their rule type is `machine_learning`.
 
 |<<browser-process-spawned-from-an-unusual-parent, Browser Process Spawned from an Unusual Parent>> |Identifies instances where an unusual process spawns a chrome browser child process. This behavior could be related to malware stealing browser information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |1
 
-|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |320
+|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |321
 
 |<<cap-sys-admin-assigned-to-binary, CAP_SYS_ADMIN Assigned to Binary>> |Identifies instances where a binary is granted the CAP_SYS_ADMIN capability. In Linux, the CAP_SYS_ADMIN capability is a powerful and broad capability that allows a process to perform a range of system administration operations, such as mounting and unmounting filesystems, configuring network interfaces, and accessing hardware devices. Attackers may leverage a misconfiguration for exploitation in order to escalate their privileges to root. The rule identifies previously unknown processes executing with CAP_SYS_ADMIN capabilities through the use of the new terms rule type. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Rule Type: BBR] |None |4
 
 |<<chkconfig-service-add, Chkconfig Service Add>> |Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Lightning Framework], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |217
 
-|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
+|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
 
-|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |318
+|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |319
 
 |<<cobalt-strike-command-and-control-beacon, Cobalt Strike Command and Control Beacon>> |Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint], [Resources: Investigation Guide] |None |106
 
@@ -508,19 +512,19 @@ and their rule type is `machine_learning`.
 
 |<<command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> |Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |313
 
-|<<command-and-scripting-interpreter-via-windows-scripts, Command and Scripting Interpreter via Windows Scripts>> |Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Elastic Endgame], [Data Source: Crowdstrike] |None |206
+|<<command-and-scripting-interpreter-via-windows-scripts, Command and Scripting Interpreter via Windows Scripts>> |Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host processes Wscript.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Elastic Endgame], [Data Source: Crowdstrike] |None |207
 
-|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |None |116
+|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |117
 
 |<<compression-dll-loaded-by-unusual-process, Compression DLL Loaded by Unusual Process>> |Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Defend], [Rule Type: BBR] |None |5
 
 |<<conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> |Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |312
 
-|<<connection-to-common-large-language-model-endpoints, Connection to Common Large Language Model Endpoints>> |Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Sysmon] |None |1
+|<<connection-to-common-large-language-model-endpoints, Connection to Common Large Language Model Endpoints>> |Identifies DNS queries to known Large Language Model domains by unsigned binaries or common Windows scripting utilities. Malwares may leverage the capabilities of LLM to perform actions in the affected system in a dynamic way. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Sysmon] |None |2
 
 |<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |210
 
-|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |121
+|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: SentinelOne] |None |122
 
 |<<connection-to-external-network-via-telnet, Connection to External Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |211
 
@@ -566,7 +570,7 @@ and their rule type is `machine_learning`.
 
 |<<cron-job-created-or-modified, Cron Job Created or Modified>> |This rule monitors for (ana)cron jobs being created or renamed. Linux cron jobs are scheduled tasks that can be leveraged by system administrators to set up scheduled tasks, but may be abused by malicious actors for persistence, privilege escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |17
 
-|<<crowdstrike-external-alerts, CrowdStrike External Alerts>> |Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app. |[Data Source: CrowdStrike], [Use Case: Threat Detection], [Resources: Investigation Guide], [Promotion: External Alerts] |8.18.0 |1
+|<<crowdstrike-external-alerts, CrowdStrike External Alerts>> |Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app. |[Data Source: Crowdstrike], [Use Case: Threat Detection], [Resources: Investigation Guide], [Promotion: External Alerts] |8.18.0 |2
 
 |<<cupsd-or-foomatic-rip-shell-execution, Cupsd or Foomatic-rip Shell Execution>> |This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects shell executions from the foomatic-rip parent process. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Use Case: Vulnerability], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |106
 
@@ -576,7 +580,7 @@ and their rule type is `machine_learning`.
 
 |<<cyberark-privileged-access-security-recommended-monitor, CyberArk Privileged Access Security Recommended Monitor>> |Identifies the occurrence of a CyberArk Privileged Access Security (PAS) non-error level audit event which is recommended for monitoring by the vendor. The event.code correlates to the CyberArk Vault Audit Action Code. |[Data Source: CyberArk PAS], [Use Case: Log Auditing], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide] |None |105
 
-|<<d-bus-service-created, D-Bus Service Created>> |This rule detects the creation of D-Bus service files on Linux systems. D-Bus is a message bus system that provides a way for applications to talk to one another. D-Bus services are defined in service files that are typically located in default directories. The rule looks for the creation of service files that are not associated with known package managers or system services. Attackers may create malicious D-Bus services to establish persistence or escalate privileges on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |4
+|<<d-bus-service-created, D-Bus Service Created>> |This rule detects the creation of D-Bus service files on Linux systems. D-Bus is a message bus system that provides a way for applications to talk to one another. D-Bus services are defined in service files that are typically located in default directories. The rule looks for the creation of service files that are not associated with known package managers or system services. Attackers may create malicious D-Bus services to establish persistence or escalate privileges on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |5
 
 |<<dnf-package-manager-plugin-file-creation, DNF Package Manager Plugin File Creation>> |Detects file creation events in the plugin directories for the Yum package manager. In Linux, DNF (Dandified YUM) is a command-line utility used for handling packages on Fedora-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor DNF to gain persistence by injecting malicious code into plugins that DNF runs, thereby ensuring continued unauthorized access or control each time DNF is used for package management. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |106
 
@@ -598,11 +602,13 @@ and their rule type is `machine_learning`.
 
 |<<delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> |Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |314
 
+|<<deprecated-execution-of-file-written-or-modified-by-pdf-reader, Deprecated - Execution of File Written or Modified by PDF Reader>> |Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |211
+
 |<<deprecated-launchdaemon-creation-or-modification-and-immediate-loading, Deprecated - LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111
 
 |<<directory-creation-in-bin-directory, Directory Creation in /bin directory>> |This rule identifies the creation of directories in the /bin directory. The /bin directory contains essential binary files that are required for the system to function properly. The creation of directories in this location could be an attempt to hide malicious files or executables, as these /bin directories usually just contain binaries. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |105
 
-|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
+|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |318
 
 |<<disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> |Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |315
 
@@ -610,7 +616,7 @@ and their rule type is `machine_learning`.
 
 |<<disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> |User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |315
 
-|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
+|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
 
 |<<discovery-of-domain-groups, Discovery of Domain Groups>> |Identifies the execution of Linux built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |4
 
@@ -662,17 +668,17 @@ and their rule type is `machine_learning`.
 
 |<<encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> |Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |415
 
-|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |216
+|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |217
 
 |<<endpoint-security-elastic-defend, Endpoint Security (Elastic Defend)>> |Generates a detection alert each time an Elastic Defend alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts. |[Data Source: Elastic Defend], [Resources: Investigation Guide] |None |108
 
 |<<entra-id-device-code-auth-with-broker-client, Entra ID Device Code Auth with Broker Client>> |Identifies device code authentication with an Azure broker client for Entra ID. Adversaries abuse Primary Refresh Tokens (PRTs) to bypass multi-factor authentication (MFA) and gain unauthorized access to Azure resources. PRTs are used in Conditional Access policies to enforce device-based controls. Compromising PRTs allows attackers to bypass these policies and gain unauthorized access. This rule detects successful sign-ins using device code authentication with the Entra ID broker client application ID (29d9ed98-a469-4536-ade2-f981bc1d605e). |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |4
 
-|<<entra-id-mfa-disabled-for-user, Entra ID MFA Disabled for User>> |Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |None |108
+|<<entra-id-mfa-disabled-for-user, Entra ID MFA Disabled for User>> |Identifies when multi-factor authentication (MFA) is disabled for an Entra ID user account. An adversary may disable MFA for a user account in order to weaken the authentication requirements for the account. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Persistence] |None |109
 
-|<<entra-id-protection-risk-detection-sign-in-risk, Entra ID Protection - Risk Detection - Sign-in Risk>> |Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Use Case: Risk Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |2
+|<<entra-id-protection-risk-detection-sign-in-risk, Entra ID Protection - Risk Detection - Sign-in Risk>> |Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Use Case: Risk Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |3
 
-|<<entra-id-protection-risk-detection-user-risk, Entra ID Protection - Risk Detection - User Risk>> |Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Use Case: Risk Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |1
+|<<entra-id-protection-risk-detection-user-risk, Entra ID Protection - Risk Detection - User Risk>> |Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Use Case: Risk Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |2
 
 |<<entra-id-rt-to-prt-transition-from-same-user-and-device, Entra ID RT to PRT Transition from Same User and Device>> |Identifies when a user signs in with a refresh token using the Microsoft Authentication Broker (MAB) client, followed by a Primary Refresh Token (PRT) sign-in from the same device within 1 hour. This pattern may indicate that an attacker has successfully registered a device using ROADtx and transitioned from short-term token access to long-term persistent access via PRTs. Excluding access to the Device Registration Service (DRS) ensures the PRT is being used beyond registration, often to access Microsoft 365 resources like Outlook or SharePoint. |[Domain: Cloud], [Domain: Identity], [Use Case: Threat Detection], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-In Logs], [Tactic: Persistence], [Tactic: Initial Access], [Resources: Investigation Guide] |None |1
 
@@ -700,7 +706,7 @@ and their rule type is `machine_learning`.
 
 |<<excessive-secret-or-key-retrieval-from-azure-key-vault, Excessive Secret or Key Retrieval from Azure Key Vault>> |Identifies excessive secret or key retrieval operations from Azure Key Vault. This rule detects when a user principal retrieves secrets or keys from Azure Key Vault multiple times within a short time frame, which may indicate potential abuse or unauthorized access attempts. The rule focuses on high-frequency retrieval operations that deviate from normal user behavior, suggesting possible credential harvesting or misuse of sensitive information. |[Domain: Cloud], [Domain: Storage], [Domain: Identity], [Data Source: Azure], [Data Source: Azure Platform Logs], [Data Source: Azure Key Vault], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |2
 
-|<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |212
+|<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |213
 
 |<<executable-bit-set-for-potential-persistence-script, Executable Bit Set for Potential Persistence Script>> |This rule monitors for the addition of an executable bit for scripts that are located in directories which are commonly abused for persistence. An alert of this rule is an indicator that a persistence mechanism is being set up within your environment. Adversaries may create these scripts to execute malicious code at start-up, or at a set interval to gain persistence onto the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |107
 
@@ -718,11 +724,9 @@ and their rule type is `machine_learning`.
 
 |<<execution-of-file-written-or-modified-by-microsoft-office, Execution of File Written or Modified by Microsoft Office>> |Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |None |113
 
-|<<execution-of-file-written-or-modified-by-pdf-reader, Execution of File Written or Modified by PDF Reader>> |Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |210
-
 |<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |210
 
-|<<execution-of-a-downloaded-windows-script, Execution of a Downloaded Windows Script>> |Identifies the creation of a Windows script downloaded from the internet followed by the execution of a scripting utility. Adversaries may use Windows script files for initial access and execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |8.15.0 |5
+|<<execution-of-a-downloaded-windows-script, Execution of a Downloaded Windows Script>> |Identifies the creation of a Windows script downloaded from the internet followed by the execution of a scripting utility. Adversaries may use Windows script files for initial access and execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
 |<<execution-of-an-unsigned-service, Execution of an Unsigned Service>> |This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |None |107
 
@@ -730,7 +734,7 @@ and their rule type is `machine_learning`.
 
 |<<execution-via-ms-visualstudio-pre-post-build-events, Execution via MS VisualStudio Pre/Post Build Events>> |Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a trusted visual studio project to execute a malicious command during the project build process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Rule Type: BBR], [Data Source: Elastic Defend] |None |4
 
-|<<execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
+|<<execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
 
 |<<execution-via-microsoft-dotnet-clickonce-host, Execution via Microsoft DotNet ClickOnce Host>> |Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |None |3
 
@@ -966,7 +970,7 @@ and their rule type is `machine_learning`.
 
 |<<high-number-of-cloned-github-repos-from-pat, High Number of Cloned GitHub Repos From PAT>> |Detects a high number of unique private repo clone events originating from a single personal access token within a short time period. |[Domain: Cloud], [Use Case: Threat Detection], [Use Case: UEBA], [Tactic: Execution], [Data Source: Github], [Resources: Investigation Guide] |None |207
 
-|<<high-number-of-egress-network-connections-from-unusual-executable, High Number of Egress Network Connections from Unusual Executable>> |This rule detects a high number of egress network connections from an unusual executable on a Linux system. This could indicate a command and control (C2) communication attempt, a brute force attack via a malware infection, or other malicious activity. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<high-number-of-egress-network-connections-from-unusual-executable, High Number of Egress Network Connections from Unusual Executable>> |This rule detects a high number of egress network connections from an unusual executable on a Linux system. This could indicate a command and control (C2) communication attempt, a brute force attack via a malware infection, or other malicious activity. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<high-number-of-okta-device-token-cookies-generated-for-authentication, High Number of Okta Device Token Cookies Generated for Authentication>> |Detects when an Okta client address has a certain threshold of Okta user authentication events with multiple device token hashes generated for single user authentication. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Credential Access], [Resources: Investigation Guide] |None |206
 
@@ -986,7 +990,7 @@ and their rule type is `machine_learning`.
 
 |<<hping-process-activity, Hping Process Activity>> |Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |212
 
-|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |315
+|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
 
 |<<ipsec-nat-traversal-port-activity, IPSEC NAT Traversal Port Activity>> |This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |108
 
@@ -1118,7 +1122,7 @@ and their rule type is `machine_learning`.
 
 |<<lsass-memory-dump-creation, LSASS Memory Dump Creation>> |Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |314
 
-|<<lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> |Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs] |None |215
+|<<lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> |Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs] |None |216
 
 |<<lsass-process-access-via-windows-api, LSASS Process Access via Windows API>> |Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide] |None |13
 
@@ -1160,13 +1164,13 @@ and their rule type is `machine_learning`.
 
 |<<m365-onedrive-excessive-file-downloads-with-oauth-token, M365 OneDrive Excessive File Downloads with OAuth Token>> |Identifies when an excessive number of files are downloaded from OneDrive using OAuth authentication. Adversaries may conduct phishing campaigns to steal OAuth tokens and impersonate users. These access tokens can then be used to download files from OneDrive. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: SharePoint], [Data Source: OneDrive], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Exfiltration], [Resources: Investigation Guide] |None |3
 
-|<<m365-portal-login-atypical-travel, M365 Portal Login (Atypical Travel)>> |Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft 365 account from an unusual location or behind a VPN. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |6
+|<<m365-portal-login-atypical-travel, M365 Portal Login (Atypical Travel)>> |Detects successful Microsoft 365 portal logins from rare locations. Rare locations are defined as locations that are not commonly associated with the user's account. This behavior may indicate an adversary attempting to access a Microsoft 365 account from an unusual location or behind a VPN. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |7
 
-|<<m365-portal-login-impossible-travel, M365 Portal Login (Impossible Travel)>> |Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |6
+|<<m365-portal-login-impossible-travel, M365 Portal Login (Impossible Travel)>> |Detects successful Microsoft 365 portal logins from impossible travel locations. Impossible travel locations are defined as two different countries within a short time frame. This behavior may indicate an adversary attempting to access a Microsoft 365 account from a compromised account or a malicious actor attempting to access a Microsoft 365 account from a different location. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Initial Access], [Resources: Investigation Guide] |None |7
 
 |<<m365-threat-intelligence-signal, M365 Threat Intelligence Signal>> |Identifies a Microsoft 365 audit log generated for Threat Intelligence signals by Microsoft Defender for Office 365. Signals generated may relate to services such as Exchange Online, SharePoint Online, OneDrive for Business and others. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Data Source: Microsoft Defender], [Data Source: Microsoft Defender Threat Intelligence], [Use Case: Threat Detection], [Tactic: Initial Access], [Resources: Investigation Guide] |None |1
 
-|<<mfa-deactivation-with-no-re-activation-for-okta-user-account, MFA Deactivation with no Re-Activation for Okta User Account>> |Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Tactic: Persistence], [Use Case: Identity and Access Audit], [Data Source: Okta], [Domain: Cloud], [Resources: Investigation Guide] |None |416
+|<<mfa-deactivation-with-no-re-activation-for-okta-user-account, MFA Deactivation with no Re-Activation for Okta User Account>> |Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Tactic: Persistence], [Use Case: Identity and Access Audit], [Data Source: Okta], [Domain: Cloud], [Resources: Investigation Guide] |None |417
 
 |<<mfa-disabled-for-google-workspace-organization, MFA Disabled for Google Workspace Organization>> |Detects when multi-factor authentication (MFA) is disabled for a Google Workspace organization. An adversary may attempt to modify a password policy in order to weaken an organization’s security controls. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |208
 
@@ -1178,9 +1182,9 @@ and their rule type is `machine_learning`.
 
 |<<machine-learning-detected-a-dns-request-with-a-high-dga-probability-score, Machine Learning Detected a DNS Request With a High DGA Probability Score>> |A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain Generation Algorithm (DGA), which could indicate command and control network activity. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control], [Resources: Investigation Guide] |None |8
 
-|<<machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |113
+|<<machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |114
 
-|<<machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |11
+|<<machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with low probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |12
 
 |<<malicious-file-detected-elastic-defend, Malicious File - Detected - Elastic Defend>> |Generates a detection alert each time an Elastic Defend alert for malicious files is received. Enabling this rule allows you to immediately begin investigating your Endpoint malicious file alerts. This rule identifies Elastic Defend malicious file detections only, and does not include prevention alerts. |[Data Source: Elastic Defend], [Tactic: Execution], [Resources: Investigation Guide] |None |5
 
@@ -1234,13 +1238,13 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-365-exchange-transport-rule-modification, Microsoft 365 Exchange Transport Rule Modification>> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration], [Resources: Investigation Guide] |None |209
 
-|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator / Company Administrator is a role that enables users to have access to all administrative features in Entra ID and services that use Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Adversaries can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |210
+|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Microsoft Entra ID, permissions to manage resources are assigned using roles. The Global Administrator / Company Administrator is a role that enables users to have access to all administrative features in Entra ID and services that use Entra ID identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Adversaries can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |211
 
-|<<microsoft-365-illicit-consent-grant-via-registered-application, Microsoft 365 Illicit Consent Grant via Registered Application>> |Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user. |[Domain: Cloud], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access], [Tactic: Credential Access] |None |3
+|<<microsoft-365-illicit-consent-grant-via-registered-application, Microsoft 365 Illicit Consent Grant via Registered Application>> |Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources in Microsoft 365. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources in Microsoft 365 on-behalf-of the user. |[Domain: Cloud], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access], [Tactic: Credential Access] |None |4
 
 |<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Collection], [Resources: Investigation Guide] |None |209
 
-|<<microsoft-365-oauth-phishing-via-visual-studio-code-client, Microsoft 365 OAuth Phishing via Visual Studio Code Client>> |Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |1
+|<<microsoft-365-oauth-phishing-via-visual-studio-code-client, Microsoft 365 OAuth Phishing via Visual Studio Code Client>> |Detects potentially suspicious OAuth authorization activity in Microsoft 365 where the Visual Studio Code first-party application (client_id = aebc6443-996d-45c2-90f0-388ff96faa56) is used to request access to Microsoft Graph resources. While this client ID is legitimately used by Visual Studio Code, threat actors have been observed abusing it in phishing campaigns to make OAuth requests appear trustworthy. These attacks rely on redirect URIs such as VSCode Insiders redirect location, prompting victims to return an OAuth authorization code that can be exchanged for access tokens. This rule may help identify unauthorized use of the VS Code OAuth flow as part of social engineering or credential phishing activity. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |2
 
 |<<microsoft-365-oauth-redirect-to-device-registration-for-user-principal, Microsoft 365 OAuth Redirect to Device Registration for User Principal>> |Identifies attempts to register a new device in Microsoft Entra ID after OAuth authentication with authorization code grant. Adversaries may use OAuth phishing techniques to obtain an OAuth authorization code, which can then be exchanged for access and refresh tokens. This rule detects a sequence of events where a user principal authenticates via OAuth, followed by a device registration event, indicating potential misuse of the OAuth flow to establish persistence or access resources. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |1
 
@@ -1280,7 +1284,7 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-entra-id-high-risk-sign-in, Microsoft Entra ID High Risk Sign-in>> |Identifies high risk Microsoft Entra ID sign-ins by leveraging Microsoft's Identity Protection machine learning and heuristics. Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, each level brings higher confidence that the user or sign-in is compromised. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |108
 
-|<<microsoft-entra-id-illicit-consent-grant-via-registered-application, Microsoft Entra ID Illicit Consent Grant via Registered Application>> |Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access], [Tactic: Credential Access] |None |216
+|<<microsoft-entra-id-illicit-consent-grant-via-registered-application, Microsoft Entra ID Illicit Consent Grant via Registered Application>> |Identifies an illicit consent grant request on-behalf-of a registered Entra ID application. Adversaries may create and register an application in Microsoft Entra ID for the purpose of requesting user consent to access resources. This is accomplished by tricking a user into granting consent to the application, typically via a pre-made phishing URL. This establishes an OAuth grant that allows the malicious client applocation to access resources on-behalf-of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access], [Tactic: Credential Access] |None |217
 
 |<<microsoft-entra-id-mfa-totp-brute-force-attempts, Microsoft Entra ID MFA TOTP Brute Force Attempts>> |Identifies brute force attempts against Azure Entra multi-factor authentication (MFA) Time-based One-Time Password (TOTP) verification codes. This rule detects high frequency failed TOTP code attempts for a single user in a short time-span with a high number of distinct session IDs. Adversaries may programmatically attemopt to brute-force TOTP codes by generating several sessions and attempt to guess the correct code. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |4
 
@@ -1296,13 +1300,13 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-entra-id-sharepoint-access-for-user-principal-via-auth-broker, Microsoft Entra ID SharePoint Access for User Principal via Auth Broker>> |This rule detects non-interactive authentication activity against SharePoint Online (`Office 365 SharePoint Online`) by a user principal via the `Microsoft Authentication Broker` application. The session leverages a refresh token or Primary Refresh Token (PRT) without interactive sign-in, often used in OAuth phishing or token replay scenarios. |[Domain: Cloud], [Use Case: Identity and Access Audit], [Tactic: Collection], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-in Logs], [Resources: Investigation Guide] |None |2
 
-|<<microsoft-entra-id-sign-in-brute-force-activity, Microsoft Entra ID Sign-In Brute Force Activity>> |Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.17.0 |4
+|<<microsoft-entra-id-sign-in-brute-force-activity, Microsoft Entra ID Sign-In Brute Force Activity>> |Identifies potential brute-force attacks targeting user accounts by analyzing failed sign-in patterns in Microsoft Entra ID Sign-In Logs. This detection focuses on a high volume of failed interactive or non-interactive authentication attempts within a short time window, often indicative of password spraying, credential stuffing, or password guessing. Adversaries may use these techniques to gain unauthorized access to applications integrated with Entra ID or to compromise valid user accounts. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Entra ID], [Data Source: Entra ID Sign-in Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |4
 
 |<<microsoft-entra-id-suspicious-cloud-device-registration, Microsoft Entra ID Suspicious Cloud Device Registration>> |Detects a sequence of events in Microsoft Entra ID indicative of a suspicious cloud-based device registration, potentially using ROADtools. This behavior involves adding a device via the Device Registration Service, followed by the assignment of registered users and owners — a pattern consistent with techniques used to establish persistence or acquire a Primary Refresh Token (PRT). ROADtools, a popular red team toolkit, often leaves distinct telemetry signatures such as the `Microsoft.OData.Client` user agent and specific OS version values. These sequences are uncommon in typical user behavior and may reflect abuse of device trust for session hijacking or silent token replay. |[Domain: Cloud], [Domain: Identity], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Tactic: Persistence], [Resources: Investigation Guide] |None |1
 
 |<<microsoft-entra-id-suspicious-session-reuse-to-graph-access, Microsoft Entra ID Suspicious Session Reuse to Graph Access>> |Identifies potential session hijacking or token replay in Microsoft Entra ID. This rule detects cases where a user signs in and subsequently accesses Microsoft Graph from a different IP address using the same session ID. This may indicate a successful OAuth phishing attack, session hijacking, or token replay attack, where an adversary has stolen a session cookie or refresh/access token and is impersonating the user from an alternate host or location. |[Domain: Cloud], [Domain: Identity], [Domain: API], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Sign-In Logs], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Defense Evasion], [Tactic: Initial Access] |None |5
 
-|<<microsoft-entra-id-user-reported-suspicious-activity, Microsoft Entra ID User Reported Suspicious Activity>> |Identifies suspicious activity reported by users in Microsoft Entra ID where users have reported suspicious activity related to their accounts, which may indicate potential compromise or unauthorized access attempts. Reported suspicious activity typically occurs during the authentication process and may involve various authentication methods, such as password resets, account recovery, or multi-factor authentication challenges. Adversaries may attempt to exploit user accounts by leveraging social engineering techniques or other methods to gain unauthorized access to sensitive information or resources. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |1
+|<<microsoft-entra-id-user-reported-suspicious-activity, Microsoft Entra ID User Reported Suspicious Activity>> |Identifies suspicious activity reported by users in Microsoft Entra ID where users have reported suspicious activity related to their accounts, which may indicate potential compromise or unauthorized access attempts. Reported suspicious activity typically occurs during the authentication process and may involve various authentication methods, such as password resets, account recovery, or multi-factor authentication challenges. Adversaries may attempt to exploit user accounts by leveraging social engineering techniques or other methods to gain unauthorized access to sensitive information or resources. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Audit Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |2
 
 |<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
 
@@ -1310,15 +1314,15 @@ and their rule type is `machine_learning`.
 
 |<<microsoft-exchange-transport-agent-install-script, Microsoft Exchange Transport Agent Install Script>> |Identifies the use of Cmdlets and methods related to Microsoft Exchange Transport Agents install. Adversaries may leverage malicious Microsoft Exchange Transport Agents to execute tasks in response to adversary-defined criteria, establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |109
 
-|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |312
+|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |313
 
-|<<microsoft-graph-first-occurrence-of-client-request, Microsoft Graph First Occurrence of Client Request>> |This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |None |2
+|<<microsoft-graph-first-occurrence-of-client-request, Microsoft Graph First Occurrence of Client Request>> |This New Terms rule focuses on the first occurrence of a client application ID (azure.graphactivitylogs.properties.app_id) making a request to Microsoft Graph API for a specific tenant ID (azure.tenant_id) and user principal object ID (azure.graphactivitylogs.properties.user_principal_object_id). This rule may helps identify unauthorized access or actions performed by compromised accounts. Advesaries may succesfully compromise a user's credentials and use the Microsoft Graph API to access resources or perform actions on behalf of the user. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Resources: Investigation Guide], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |None |3
 
 |<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
 
 |<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR], [Data Source: Windows Security Event Logs] |None |217
 
-|<<microsoft-management-console-file-from-unusual-path, Microsoft Management Console File from Unusual Path>> |Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike], [Resources: Investigation Guide], [Data Source: Sysmon] |None |312
+|<<microsoft-management-console-file-from-unusual-path, Microsoft Management Console File from Unusual Path>> |Identifies attempts to open a Microsoft Management Console File from untrusted paths. Adversaries may use MSC files for initial access and execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike], [Resources: Investigation Guide], [Data Source: Sysmon] |None |313
 
 |<<microsoft-sentinel-external-alerts, Microsoft Sentinel External Alerts>> |Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Microsoft Sentinel alerts in the app. |[Data Source: Microsoft Sentinel], [Use Case: Threat Detection], [Resources: Investigation Guide], [Promotion: External Alerts] |8.18.0 |1
 
@@ -1340,7 +1344,7 @@ and their rule type is `machine_learning`.
 
 |<<modification-of-standard-authentication-module-or-configuration, Modification of Standard Authentication Module or Configuration>> |Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |207
 
-|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |213
+|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |214
 
 |<<modification-of-the-mspkiaccountcredentials, Modification of the msPKIAccountCredentials>> |Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Data Source: Active Directory], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |117
 
@@ -1372,11 +1376,11 @@ and their rule type is `machine_learning`.
 
 |<<multiple-microsoft-365-user-account-lockouts-in-short-time-window, Multiple Microsoft 365 User Account Lockouts in Short Time Window>> |Detects a burst of Microsoft 365 user account lockouts within a short 5-minute window. A high number of IdsLocked login errors across multiple user accounts may indicate brute-force attempts for the same users resulting in lockouts. |[Domain: Cloud], [Domain: SaaS], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Threat Detection], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Resources: Investigation Guide] |None |3
 
-|<<multiple-microsoft-entra-id-protection-alerts-by-user-principal, Multiple Microsoft Entra ID Protection Alerts by User Principal>> |Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Protection Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |1
+|<<multiple-microsoft-entra-id-protection-alerts-by-user-principal, Multiple Microsoft Entra ID Protection Alerts by User Principal>> |Identifies more than two Microsoft Entra ID Protection alerts associated to the user principal in a short time period. Microsoft Entra ID Protection alerts are triggered by suspicious sign-in activity, such as anomalous IP addresses, risky sign-ins, or other risk detections. Multiple alerts in a short time frame may indicate an ongoing attack or compromised account. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Entra ID], [Data Source: Microsoft Entra ID Protection Logs], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |None |2
 
 |<<multiple-okta-sessions-detected-for-a-single-user, Multiple Okta Sessions Detected for a Single User>> |Detects when a user has started multiple Okta sessions with the same user account and different session IDs. This may indicate that an attacker has stolen the user's session cookie and is using it to access the user's account from a different location. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Lateral Movement], [Resources: Investigation Guide] |None |210
 
-|<<multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy, Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy>> |Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Credential Access], [Resources: Investigation Guide] |None |209
+|<<multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy, Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy>> |Detects when Okta user authentication events are reported for multiple users with the same device token hash behind a proxy. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Credential Access], [Resources: Investigation Guide] |None |210
 
 |<<multiple-okta-user-authentication-events-with-client-address, Multiple Okta User Authentication Events with Client Address>> |Detects when a certain threshold of Okta user authentication events are reported for multiple users from the same client address. Adversaries may attempt to launch a credential stuffing or password spraying attack from the same device by using a list of known usernames and passwords to gain unauthorized access to user accounts. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Credential Access], [Resources: Investigation Guide] |None |206
 
@@ -1402,7 +1406,7 @@ and their rule type is `machine_learning`.
 
 |<<network-activity-detected-via-cat, Network Activity Detected via cat>> |This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
-|<<network-activity-to-a-suspicious-top-level-domain, Network Activity to a Suspicious Top Level Domain>> |Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executable running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Data Source: Sysmon] |None |1
+|<<network-activity-to-a-suspicious-top-level-domain, Network Activity to a Suspicious Top Level Domain>> |Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or executable running from world writable directories or unsigned binaries. This behavior matches on common malware C2 abusing less formal domain names. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Data Source: Sysmon] |None |2
 
 |<<network-connection-initiated-by-sshd-child-process, Network Connection Initiated by SSHD Child Process>> |This rule identifies an egress internet connection initiated by an SSH Daemon child process. This behavior is indicative of the alteration of a shell configuration file or other mechanism that launches a process when a new SSH login occurs. Attackers can also backdoor the SSH daemon to allow for persistence, call out to a C2 or to steal credentials. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |7
 
@@ -1468,7 +1472,7 @@ and their rule type is `machine_learning`.
 
 |<<okta-fastpass-phishing-detection, Okta FastPass Phishing Detection>> |Detects when Okta FastPass prevents a user from authenticating to a phishing website. |[Tactic: Initial Access], [Use Case: Identity and Access Audit], [Data Source: Okta], [Resources: Investigation Guide] |None |310
 
-|<<okta-sign-in-events-via-third-party-idp, Okta Sign-In Events via Third-Party IdP>> |Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP). |[Use Case: Identity and Access Audit], [Tactic: Initial Access], [Data Source: Okta], [Resources: Investigation Guide] |None |209
+|<<okta-sign-in-events-via-third-party-idp, Okta Sign-In Events via Third-Party IdP>> |Detects sign-in events where authentication is carried out via a third-party Identity Provider (IdP). |[Use Case: Identity and Access Audit], [Tactic: Initial Access], [Data Source: Okta], [Resources: Investigation Guide] |None |210
 
 |<<okta-threatinsight-threat-suspected-promotion, Okta ThreatInsight Threat Suspected Promotion>> |Okta ThreatInsight is a feature that provides valuable debug data regarding authentication and authorization processes, which is logged in the system. Within this data, there is a specific field called threat_suspected, which represents Okta's internal evaluation of the authentication or authorization workflow. When this field is set to True, it suggests the presence of potential credential access techniques, such as password-spraying, brute-forcing, replay attacks, and other similar threats. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Resources: Investigation Guide] |None |412
 
@@ -1484,7 +1488,7 @@ and their rule type is `machine_learning`.
 
 |<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |212
 
-|<<outlook-home-page-registry-modification, Outlook Home Page Registry Modification>> |Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide], [Data Source: Crowdstrike] |None |206
+|<<outlook-home-page-registry-modification, Outlook Home Page Registry Modification>> |Identifies modifications in registry keys associated with abuse of the Outlook Home Page functionality for command and control or persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide], [Data Source: Crowdstrike] |None |207
 
 |<<parent-process-detected-with-suspicious-windows-process-es, Parent Process Detected with Suspicious Windows Process(es)>> |A machine learning job combination has identified a parent process with one or more suspicious Windows processes that exhibit unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |110
 
@@ -1578,7 +1582,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-cookies-theft-via-browser-debugging, Potential Cookies Theft via Browser Debugging>> |Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials. |[Domain: Endpoint], [OS: Linux], [OS: Windows], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs], [Data Source: Sysmon] |None |211
 
-|<<potential-credential-access-via-dcsync, Potential Credential Access via DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Windows Security Event Logs] |None |219
+|<<potential-credential-access-via-dcsync, Potential Credential Access via DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Windows Security Event Logs] |None |220
 
 |<<potential-credential-access-via-duplicatehandle-in-lsass, Potential Credential Access via DuplicateHandle in LSASS>> |Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon], [Resources: Investigation Guide] |None |311
 
@@ -1590,13 +1594,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-credential-access-via-trusted-developer-utility, Potential Credential Access via Trusted Developer Utility>> |An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |213
 
-|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon] |None |318
+|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon] |None |319
 
 |<<potential-dga-activity, Potential DGA Activity>> |A population analysis machine learning job detected potential DGA (domain generation algorithm) activity. Such activity is often used by malware command and control (C2) channels. This machine learning job looks for a source IP address making DNS requests that have an aggregate high probability of being DGA activity. |[Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control], [Resources: Investigation Guide] |None |8
 
-|<<potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> |Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |215
-
-|<<potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide], [Data Source: Crowdstrike] |None |216
+|<<potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide], [Data Source: Crowdstrike], [Data Source: SentinelOne] |None |217
 
 |<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon] |None |314
 
@@ -1646,7 +1648,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-fake-captcha-phishing-attack, Potential Fake CAPTCHA Phishing Attack>> |Identifies potential fake CAPTCHA phishing attack based on PowerShell or Cmd argument values. Adversaries employ this technique via compromised websites with browser injects, posing either as fake CAPTCHAs to access the site or as a page loading error requiring a fix to display the page. The victim is instructed to copy and past a malicious command to the Windows Run dialog box. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Windows Security Event Logs], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |1
 
-|<<potential-file-download-via-a-headless-browser, Potential File Download via a Headless Browser>> |Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries may use browsers to avoid ingress tool transfer restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Windows], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon], [Data Source: Crowdstrike] |None |206
+|<<potential-file-download-via-a-headless-browser, Potential File Download via a Headless Browser>> |Identifies the use of a browser to download a file from a remote URL and from a suspicious parent process. Adversaries may use browsers to avoid ingress tool transfer restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Windows], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon], [Data Source: Crowdstrike] |None |207
 
 |<<potential-file-transfer-via-certreq, Potential File Transfer via Certreq>> |Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |214
 
@@ -1708,7 +1710,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-malicious-powershell-based-on-alert-correlation, Potential Malicious PowerShell Based on Alert Correlation>> |Identifies PowerShell script blocks associated with multiple distinct detections, indicating likely malicious behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Rule Type: Higher-Order Rule], [Resources: Investigation Guide] |None |2
 
-|<<potential-malware-driven-ssh-brute-force-attempt, Potential Malware-Driven SSH Brute Force Attempt>> |This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<potential-malware-driven-ssh-brute-force-attempt, Potential Malware-Driven SSH Brute Force Attempt>> |This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |None |9
 
@@ -1730,7 +1732,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |110
 
-|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |215
+|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |216
 
 |<<potential-netntlmv1-downgrade-attack, Potential NetNTLMv1 Downgrade Attack>> |Identifies registry modification to force the system to fall back to NTLMv1 for authentication. This modification is possible with local administrator privileges and is commonly referred to as a `NetNTLMv1 downgrade attack`. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Sysmon], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |3
 
@@ -1746,7 +1748,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-non-standard-port-ssh-connection, Potential Non-Standard Port SSH connection>> |Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [OS: macOS], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |9
 
-|<<potential-okta-mfa-bombing-via-push-notifications, Potential Okta MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta], [Resources: Investigation Guide] |None |210
+|<<potential-okta-mfa-bombing-via-push-notifications, Potential Okta MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Domain: Identity], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta], [Data Source: Okta System Logs], [Resources: Investigation Guide] |None |211
 
 |<<potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> |Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |213
 
@@ -1766,11 +1768,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> |Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Resources: Investigation Guide] |None |111
 
-|<<potential-port-scanning-activity-from-compromised-host, Potential Port Scanning Activity from Compromised Host>> |This rule detects potential port scanning activity from a compromised host. Port scanning is a common reconnaissance technique used by attackers to identify open ports and services on a target system. A compromised host may exhibit port scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable services, or prepare for further exploitation. This rule identifies potential port scanning activity by monitoring network connection attempts from a single host to a large number of ports within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<potential-port-scanning-activity-from-compromised-host, Potential Port Scanning Activity from Compromised Host>> |This rule detects potential port scanning activity from a compromised host. Port scanning is a common reconnaissance technique used by attackers to identify open ports and services on a target system. A compromised host may exhibit port scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable services, or prepare for further exploitation. This rule identifies potential port scanning activity by monitoring network connection attempts from a single host to a large number of ports within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
-|<<potential-powershell-hacktool-script-by-author, Potential PowerShell HackTool Script by Author>> |Detects known PowerShell offensive tooling author's name in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code, which may still contain the author artifacts. This rule identifies common author handles found in popular PowerShell scripts used for red team exercises. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |107
+|<<potential-powershell-hacktool-script-by-author, Potential PowerShell HackTool Script by Author>> |Detects known PowerShell offensive tooling author's name in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code, which may still contain the author artifacts. This rule identifies common author handles found in popular PowerShell scripts used for red team exercises. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |108
 
-|<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |217
+|<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |218
 
 |<<potential-powershell-obfuscated-script, Potential PowerShell Obfuscated Script>> |Identifies scripts that contain patterns and known methods that obfuscate PowerShell code. Attackers can use obfuscation techniques to bypass PowerShell security protections such as Antimalware Scan Interface (AMSI). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |107
 
@@ -1844,7 +1846,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-remcos-trojan-execution, Potential REMCOS Trojan Execution>> |Identifies known execution traces of the REMCOS Remote Access Trojan. Remcos RAT is used by attackers to perform actions on infected machines remotely. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs] |None |1
 
-|<<potential-ransomware-behavior-high-count-of-readme-files-by-system, Potential Ransomware Behavior - High count of Readme files by System>> |This rule identifies a high number (20) of file creation event by the System virtual process from the same host and with same file name containing keywords similar to ransomware note files and all within a short time period. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne] |None |209
+|<<potential-ransomware-behavior-high-count-of-readme-files-by-system, Potential Ransomware Behavior - High count of Readme files by System>> |This rule identifies a high number (20) of file creation event by the System virtual process from the same host and with same file name containing keywords similar to ransomware note files and all within a short time period. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne] |None |210
 
 |<<potential-ransomware-note-file-dropped-via-smb, Potential Ransomware Note File Dropped via SMB>> |Identifies an incoming SMB connection followed by the creation of a file with a name similar to ransomware note files. This may indicate a remote ransomware attack via the SMB protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |6
 
@@ -1852,7 +1854,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> |Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |113
 
-|<<potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> |Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |312
+|<<potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> |Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |313
 
 |<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Microsoft Defender for Endpoint], [Data Source: Windows Security Event Logs], [Data Source: Crowdstrike], [Data Source: Sysmon] |None |419
 
@@ -1892,7 +1894,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-shell-via-wildcard-injection-detected, Potential Shell via Wildcard Injection Detected>> |This rule monitors for the execution of a set of linux binaries, that are potentially vulnerable to wildcard injection, with suspicious command line flags followed by a shell spawn event. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |110
 
-|<<potential-subnet-scanning-activity-from-compromised-host, Potential Subnet Scanning Activity from Compromised Host>> |This rule detects potential subnet scanning activity from a compromised host. Subnet scanning is a common reconnaissance technique used by attackers to identify live hosts within a network range. A compromised host may exhibit subnet scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable hosts, or prepare for further exploitation. This rule identifies potential subnet scanning activity by monitoring network connection attempts from a single host to a large number of hosts within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<potential-subnet-scanning-activity-from-compromised-host, Potential Subnet Scanning Activity from Compromised Host>> |This rule detects potential subnet scanning activity from a compromised host. Subnet scanning is a common reconnaissance technique used by attackers to identify live hosts within a network range. A compromised host may exhibit subnet scanning behavior when an attacker is attempting to map out the network topology, identify vulnerable hosts, or prepare for further exploitation. This rule identifies potential subnet scanning activity by monitoring network connection attempts from a single host to a large number of hosts within a short time frame. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> |An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |None |10
 
@@ -1910,7 +1912,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-suspicious-file-edit, Potential Suspicious File Edit>> |This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |109
 
-|<<potential-system-tampering-via-file-modification, Potential System Tampering via File Modification>> |Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Impact], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |1
+|<<potential-system-tampering-via-file-modification, Potential System Tampering via File Modification>> |Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Impact], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |2
 
 |<<potential-toolshell-initial-exploit-cve-2025-53770-cve-2025-53771, Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)>> |Identifies potential exploitation of CVE-2025-53770 and CVE-2025-53771 in IIS web servers on SharePoint sites. Toolshell is an exploit chain that leverages vulnerabilities in SharePoint/IIS to gain unauthorized access and execute commands. This rule detects HTTP requests that match specific patterns indicative of the exploit attempt. |[Domain: Network], [Tactic: Initial Access], [Use Case: Exploit Detection], [Data Source: Network Traffic], [Data Source: Network Traffic HTTP Logs], [Rule Type: BBR] |None |1
 
@@ -1938,9 +1940,9 @@ and their rule type is `machine_learning`.
 
 |<<potential-macos-ssh-brute-force-detected, Potential macOS SSH Brute Force Detected>> |Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |111
 
-|<<potential-privilege-escalation-via-cve-2022-38028, Potential privilege escalation via CVE-2022-38028>> |Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijack the print spooler service execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |207
+|<<potential-privilege-escalation-via-cve-2022-38028, Potential privilege escalation via CVE-2022-38028>> |Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijack the print spooler service execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |208
 
-|<<potentially-successful-mfa-bombing-via-push-notifications, Potentially Successful MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta], [Resources: Investigation Guide] |None |416
+|<<potentially-successful-okta-mfa-bombing-via-push-notifications, Potentially Successful Okta MFA Bombing via Push Notifications>> |Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access. |[Domain: Identity], [Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta], [Data Source: Okta System Logs], [Resources: Investigation Guide] |None |417
 
 |<<potentially-suspicious-process-started-via-tmux-or-screen, Potentially Suspicious Process Started via tmux or screen>> |This rule monitors for the execution of suspicious commands via screen and tmux. When launching a command and detaching directly, the commands will be executed in the background via its parent process. Attackers may leverage screen or tmux to execute commands while attempting to evade detection. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |109
 
@@ -1948,11 +1950,11 @@ and their rule type is `machine_learning`.
 
 |<<powershell-kerberos-ticket-dump, PowerShell Kerberos Ticket Dump>> |Detects PowerShell scripts that have the capability of dumping Kerberos tickets from LSA, which potentially indicates an attacker's attempt to acquire credentials for lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |110
 
-|<<powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> |Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |215
+|<<powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> |Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |216
 
 |<<powershell-keylogging-script, PowerShell Keylogging Script>> |Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |217
 
-|<<powershell-mailbox-collection-script, PowerShell Mailbox Collection Script>> |Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |111
+|<<powershell-mailbox-collection-script, PowerShell Mailbox Collection Script>> |Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |112
 
 |<<powershell-minidump-script, PowerShell MiniDump Script>> |This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |212
 
@@ -1970,7 +1972,7 @@ and their rule type is `machine_learning`.
 
 |<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |210
 
-|<<powershell-script-with-password-policy-discovery-capabilities, PowerShell Script with Password Policy Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |109
+|<<powershell-script-with-password-policy-discovery-capabilities, PowerShell Script with Password Policy Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |110
 
 |<<powershell-script-with-remote-execution-capabilities-via-winrm, PowerShell Script with Remote Execution Capabilities via WinRM>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |211
 
@@ -1980,17 +1982,17 @@ and their rule type is `machine_learning`.
 
 |<<powershell-script-with-webcam-video-capture-capabilities, PowerShell Script with Webcam Video Capture Capabilities>> |Detects PowerShell scripts that can be used to record webcam video. Attackers can capture this information to extort or spy on victims. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |109
 
-|<<powershell-script-with-windows-defender-tampering-capabilities, PowerShell Script with Windows Defender Tampering Capabilities>> |Identifies PowerShell scripts containing cmdlets and parameters that attackers can abuse to disable Windows Defender features. Attackers can tamper with antivirus to reduce the risk of detection when executing their payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |None |106
+|<<powershell-script-with-windows-defender-tampering-capabilities, PowerShell Script with Windows Defender Tampering Capabilities>> |Identifies PowerShell scripts containing cmdlets and parameters that attackers can abuse to disable Windows Defender features. Attackers can tamper with antivirus to reduce the risk of detection when executing their payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |107
 
-|<<powershell-share-enumeration-script, PowerShell Share Enumeration Script>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |113
+|<<powershell-share-enumeration-script, PowerShell Share Enumeration Script>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |114
 
 |<<powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> |This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |318
 
 |<<powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> |Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |317
 
-|<<powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> |Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |214
+|<<powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> |Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |215
 
-|<<powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> |Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |212
+|<<powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> |Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |None |213
 
 |<<powershell-suspicious-script-with-screenshot-capabilities, PowerShell Suspicious Script with Screenshot Capabilities>> |Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |None |212
 
@@ -2012,7 +2014,7 @@ and their rule type is `machine_learning`.
 
 |<<privilege-escalation-via-suid-sgid, Privilege Escalation via SUID/SGID>> |Identifies instances where a process is executed with user/group ID 0 (root), and a real user/group ID that is not 0. This is indicative of a process that has been granted SUID/SGID permissions, allowing it to run with elevated privileges. Attackers may leverage a misconfiguration for exploitation in order to escalate their privileges to root, or establish a backdoor for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |109
 
-|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |312
+|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |313
 
 |<<privileged-account-brute-force, Privileged Account Brute Force>> |Identifies multiple consecutive logon failures targeting an Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs] |None |114
 
@@ -2118,7 +2120,7 @@ and their rule type is `machine_learning`.
 
 |<<remote-desktop-file-opened-from-suspicious-path, Remote Desktop File Opened from Suspicious Path>> |Identifies attempts to open a remote desktop file from suspicious paths. Adversaries may abuse RDP files for initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |6
 
-|<<remote-execution-via-file-shares, Remote Execution via File Shares>> |Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |None |119
+|<<remote-execution-via-file-shares, Remote Execution via File Shares>> |Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |None |120
 
 |<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |316
 
@@ -2130,7 +2132,7 @@ and their rule type is `machine_learning`.
 
 |<<remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> |Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |318
 
-|<<remote-file-download-via-powershell, Remote File Download via PowerShell>> |Identifies powershell.exe being used to download an executable file from an untrusted remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |113
+|<<remote-file-download-via-powershell, Remote File Download via PowerShell>> |Identifies powershell.exe being used to download an executable file from an untrusted remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |114
 
 |<<remote-file-download-via-script-interpreter, Remote File Download via Script Interpreter>> |Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) being used to download an executable file from a remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |213
 
@@ -2170,8 +2172,6 @@ and their rule type is `machine_learning`.
 
 |<<smtp-on-port-26-tcp, SMTP on Port 26/TCP>> |This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection], [Data Source: PAN-OS], [Resources: Investigation Guide] |None |108
 
-|<<sns-topic-message-publish-by-rare-user, SNS Topic Message Publish by Rare User>> |Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that only flags when this behavior is observed for the first time on a user in the last 14 days. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SNS], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Lateral Movement], [Tactic: Exfiltration] |None |3
-
 |<<ssh-authorized-keys-file-deletion, SSH Authorized Keys File Deletion>> |This rule detects the deletion of the authorized_keys or authorized_keys2 files on Linux systems. These files are used to store public keys for SSH authentication. Unauthorized deletion of these files can be an indicator of an attacker removing access to the system, and may be a precursor to further malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
 |<<ssh-authorized-keys-file-modification, SSH Authorized Keys File Modification>> |The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s). |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |209
@@ -2182,8 +2182,6 @@ and their rule type is `machine_learning`.
 
 |<<ssl-certificate-deletion, SSL Certificate Deletion>> |This rule detects the deletion of SSL certificates on a Linux system. Adversaries may delete SSL certificates to subvert trust controls and negatively impact the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Impact], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |104
 
-|<<ssm-session-started-to-ec2-instance, SSM Session Started to EC2 Instance>> |Identifies the first occurrence of an AWS resource establishing a session via SSM to an EC2 instance. Adversaries may use AWS Systems Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation. This rule helps detect the first occurrence of this activity for a given AWS resource. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Data Source: AWS SSM], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide] |None |4
-
 |<<suid-sgid-bit-set, SUID/SGID Bit Set>> |An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |108
 
 |<<suid-sguid-enumeration-detected, SUID/SGUID Enumeration Detected>> |This rule monitors for the usage of the "find" command in conjunction with SUID and SGUID permission arguments. SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow a program to execute with the privileges of the file owner or group, respectively, rather than the privileges of the user running the program. In case an attacker is able to enumerate and find a binary that is misconfigured, they might be able to leverage this misconfiguration to escalate privileges by exploiting vulnerabilities or built-in features in the privileged program. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Privilege Escalation], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
@@ -2196,7 +2194,7 @@ and their rule type is `machine_learning`.
 
 |<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |314
 
-|<<screenconnect-server-spawning-suspicious-processes, ScreenConnect Server Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |207
+|<<screenconnect-server-spawning-suspicious-processes, ScreenConnect Server Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |208
 
 |<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |112
 
@@ -2338,7 +2336,7 @@ and their rule type is `machine_learning`.
 
 |<<successful-ssh-authentication-from-unusual-ip-address, Successful SSH Authentication from Unusual IP Address>> |This rule leverages the new_terms rule type to detect successful SSH authentications by an IP- address that has not been authenticated in the last 10 days. This behavior may indicate an attacker attempting to gain access to the system using a valid account. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
 
-|<<successful-ssh-authentication-from-unusual-ssh-public-key, Successful SSH Authentication from Unusual SSH Public Key>> |This rule leverages the new_terms rule type to detect successful SSH authentications via a public key that has not been seen in the last 10 days. Public key authentication is a secure method for authenticating users to a server. Monitoring unusual public key authentication events can help detect unauthorized access attempts or suspicious activity on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
+|<<successful-ssh-authentication-from-unusual-ssh-public-key, Successful SSH Authentication from Unusual SSH Public Key>> |This rule leverages the new_terms rule type to detect successful SSH authentications via a public key that has not been seen in the last 10 days. Public key authentication is a secure method for authenticating users to a server. Monitoring unusual public key authentication events can help detect unauthorized access attempts or suspicious activity on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |4
 
 |<<successful-ssh-authentication-from-unusual-user, Successful SSH Authentication from Unusual User>> |This rule leverages the new_terms rule type to detect successful SSH authentications by a user who has not been authenticated in the last 10 days. This behavior may indicate an attacker attempting to gain access to the system using a valid account. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |3
 
@@ -2360,7 +2358,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-apt-package-manager-network-connection, Suspicious APT Package Manager Network Connection>> |Detects suspicious network events executed by the APT package manager, potentially indicating persistence through an APT backdoor. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Command and Control], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |8
 
-|<<suspicious-access-to-ldap-attributes, Suspicious Access to LDAP Attributes>> |Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Windows Security Event Logs], [Data Source: Active Directory], [Data Source: Windows], [Resources: Investigation Guide] |None |106
+|<<suspicious-access-to-ldap-attributes, Suspicious Access to LDAP Attributes>> |Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Windows Security Event Logs], [Data Source: Active Directory], [Data Source: Windows], [Resources: Investigation Guide] |None |107
 
 |<<suspicious-activity-reported-by-okta-user, Suspicious Activity Reported by Okta User>> |Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access], [Resources: Investigation Guide] |None |412
 
@@ -2390,7 +2388,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-dynamic-linker-discovery-via-od, Suspicious Dynamic Linker Discovery via od>> |Monitors for dynamic linker discovery via the od utility. od (octal dump) is a command-line utility in Unix operating systems used for displaying data in various formats, including octal, hexadecimal, decimal, and ASCII, primarily used for examining and debugging binary files or data streams. Attackers can leverage od to analyze the dynamic linker by identifying injection points and craft exploits based on the observed behaviors and structures within these files. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |106
 
-|<<suspicious-email-access-by-first-party-application-via-microsoft-graph, Suspicious Email Access by First-Party Application via Microsoft Graph>> |Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide] |None |1
+|<<suspicious-email-access-by-first-party-application-via-microsoft-graph, Suspicious Email Access by First-Party Application via Microsoft Graph>> |Identifies access to email resources via Microsoft Graph API using an first-party application on behalf of a user principal. This behavior may indicate an adversary using a phished OAuth refresh token or a Primary Refresh Token (PRT) to access email resources. The pattern includes requests to Microsoft Graph API endpoints related to email, such as /me/mailFolders/inbox/messages or /users/{user_id}/messages, using a public client application ID and a user principal object ID. This is a New Terms rule that only signals if the application ID and user principal object ID have not been seen doing this activity in the last 14 days. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft Graph], [Data Source: Microsoft Graph Activity Logs], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide] |None |2
 
 |<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |112
 
@@ -2400,7 +2398,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-execution-from-foomatic-rip-or-cupsd-parent, Suspicious Execution from Foomatic-rip or Cupsd Parent>> |This detection rule addresses multiple vulnerabilities in the CUPS printing system, including CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177. Specifically, this rule detects suspicious process command lines executed by child processes of foomatic-rip and cupsd. These flaws impact components like cups-browsed, libcupsfilters, libppd, and foomatic-rip, allowing remote unauthenticated attackers to manipulate IPP URLs or inject malicious data through crafted UDP packets or network spoofing. This can result in arbitrary command execution when a print job is initiated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Use Case: Vulnerability], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |106
 
-|<<suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> |Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |209
+|<<suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> |Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |210
 
 |<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |211
 
@@ -2460,7 +2458,9 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-microsoft-365-userloggedin-via-oauth-code, Suspicious Microsoft 365 UserLoggedIn via OAuth Code>> |Identifies sign-ins on behalf of a principal user to the Microsoft Graph API from multiple IPs using the Microsoft Authentication Broker or Visual Studio Code application. This behavior may indicate an adversary using a phished OAuth refresh token. |[Domain: Cloud], [Domain: Email], [Domain: Identity], [Data Source: Microsoft 365], [Data Source: Microsoft 365 Audit Logs], [Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Resources: Investigation Guide], [Tactic: Defense Evasion] |None |3
 
-|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |214
+|<<suspicious-microsoft-antimalware-service-execution, Suspicious Microsoft Antimalware Service Execution>> |Identifies suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances. This may indicate an attempt to evade defenses through DLL side-loading or by masquerading as the antimalware process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |216
+
+|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |215
 
 |<<suspicious-microsoft-html-application-child-process, Suspicious Microsoft HTML Application Child Process>> |Identifies Mshta.exe spawning a suspicious child process. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |1
 
@@ -2528,7 +2528,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> |A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |213
 
-|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
+|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |318
 
 |<<suspicious-symbolic-link-created, Suspicious Symbolic Link Created>> |Identifies the creation of a symbolic link to a suspicious file or location. A symbolic link is a reference to a file or directory that acts as a pointer or shortcut, allowing users to access the target file or directory from a different location in the file system. An attacker can potentially leverage symbolic links for privilege escalation by tricking a privileged process into following the symbolic link to a sensitive file, giving the attacker access to data or capabilities they would not normally have. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |10
 
@@ -2578,7 +2578,7 @@ and their rule type is `machine_learning`.
 
 |<<system-binary-symlink-to-suspicious-location, System Binary Symlink to Suspicious Location>> |This rule detects the creation of a symbolic link from a system binary to a suspicious and writable location. This activity may indicate an attacker's attempt to evade detection by behavioral rules that depend on predefined process parent/child relationships. By executing the symlinked variant of a binary instead of the original, the attacker aims to bypass these rules. Through the new_terms rule type, this rule can identify uncommon parent processes that may indicate the presence of a malicious symlink. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |2
 
-|<<system-file-onwership-change, System File Onwership Change>> |Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |1
+|<<system-file-ownership-change, System File Ownership Change>> |Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |2
 
 |<<system-hosts-file-access, System Hosts File Access>> |Identifies the use of built-in tools to read the contents of \etc\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |5
 
@@ -2590,7 +2590,7 @@ and their rule type is `machine_learning`.
 
 |<<system-owner-user-discovery-linux, System Owner/User Discovery Linux>> |Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |None |5
 
-|<<system-public-ip-discovery-via-dns-query, System Public IP Discovery via DNS Query>> |Identifies DNS queries to known public IP address lookup web services. Malwares tend to perform this action to assess potential targets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Data Source: Sysmon] |None |1
+|<<system-public-ip-discovery-via-dns-query, System Public IP Discovery via DNS Query>> |Identifies DNS queries to known public IP address lookup web services. Malwares tend to perform this action to assess potential targets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Data Source: Sysmon] |None |2
 
 |<<system-service-discovery-through-built-in-windows-utilities, System Service Discovery through built-in Windows Utilities>> |Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR], [Data Source: Windows Security Event Logs] |None |112
 
@@ -2684,7 +2684,7 @@ and their rule type is `machine_learning`.
 
 |<<untrusted-dll-loaded-by-azure-ad-sync-service, Untrusted DLL Loaded by Azure AD Sync Service>> |Identifies the load of a DLL without a valid code signature by the Azure AD Sync process, which may indicate an attempt to persist or collect sensitive credentials passing through the Azure AD synchronization server. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |105
 
-|<<untrusted-driver-loaded, Untrusted Driver Loaded>> |Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |12
+|<<untrusted-driver-loaded, Untrusted Driver Loaded>> |Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |None |13
 
 |<<unusual-aws-command-for-a-user, Unusual AWS Command for a User>> |A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |211
 
@@ -2692,15 +2692,15 @@ and their rule type is `machine_learning`.
 
 |<<unusual-base64-encoding-decoding-activity, Unusual Base64 Encoding/Decoding Activity>> |This rule leverages ESQL to detect unusual base64 encoding/decoding activity on Linux systems. Attackers may use base64 encoding/decoding to obfuscate data, such as command and control traffic or payloads, to evade detection by host- or network-based security controls. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
 
-|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |316
+|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Resources: Investigation Guide] |None |317
 
-|<<unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
+|<<unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
 
 |<<unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> |Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |213
 
 |<<unusual-city-for-an-aws-command, Unusual City For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |211
 
-|<<unusual-command-execution-from-web-server-parent, Unusual Command Execution from Web Server Parent>> |This rule detects potential command execution from a web server parent process on a Linux host. Adversaries may attempt to execute commands from a web server parent process to blend in with normal web server activity and evade detection. This behavior is commonly observed in web shell attacks where adversaries exploit web server vulnerabilities to execute arbitrary commands on the host. The detection rule identifies unusual command execution from web server parent processes, which may indicate a compromised host or an ongoing attack. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<unusual-command-execution-from-web-server-parent, Unusual Command Execution from Web Server Parent>> |This rule detects potential command execution from a web server parent process on a Linux host. Adversaries may attempt to execute commands from a web server parent process to blend in with normal web server activity and evade detection. This behavior is commonly observed in web shell attacks where adversaries exploit web server vulnerabilities to execute arbitrary commands on the host. The detection rule identifies unusual command execution from web server parent processes, which may indicate a compromised host or an ongoing attack. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<unusual-country-for-an-aws-command, Unusual Country For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |None |211
 
@@ -2720,7 +2720,7 @@ and their rule type is `machine_learning`.
 
 |<<unusual-execution-from-kernel-thread-kthreadd-parent, Unusual Execution from Kernel Thread (kthreadd) Parent>> |This rule detects suspicious child process from the kernel thread (kthreadd) parent process. Attackers may execute payloads from kernel space via kthreadd to perform actions on the host and evade detection. Through the usage of the new_terms rule type, this rule can identify uncommon child processes that may indicate the presence of a malicious process. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |2
 
-|<<unusual-execution-via-microsoft-common-console-file, Unusual Execution via Microsoft Common Console File>> |Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |204
+|<<unusual-execution-via-microsoft-common-console-file, Unusual Execution via Microsoft Common Console File>> |Identifies the execution of a child process from a Microsoft Common Console file. Adversaries may embed a malicious command in an MSC file in order to trick victims into executing malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne] |None |205
 
 |<<unusual-exim4-child-process, Unusual Exim4 Child Process>> |This rule detects the execution of unusual commands via a descendant process of exim4. Attackers may use descendant processes of exim4 to evade detection and establish persistence or execute post-exploitation commands on a target system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |2
 
@@ -2728,9 +2728,9 @@ and their rule type is `machine_learning`.
 
 |<<unusual-file-creation-by-web-server, Unusual File Creation by Web Server>> |This rule detects unusual file creations from a web server parent process. Adversaries may attempt to create files from a web server parent process to establish persistence, execute malicious scripts, or exfiltrate data. ES|QL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Rule Type: BBR] |None |4
 
-|<<unusual-file-modification-by-dns-exe, Unusual File Modification by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |214
+|<<unusual-file-operation-by-dns-exe, Unusual File Operation by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |None |215
 
-|<<unusual-file-transfer-utility-launched, Unusual File Transfer Utility Launched>> |This rule leverages ESQL to detect the execution of unusual file transfer utilities on Linux systems. Attackers may use these utilities to exfiltrate data from a compromised system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Exfiltration], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<unusual-file-transfer-utility-launched, Unusual File Transfer Utility Launched>> |This rule leverages ESQL to detect the execution of unusual file transfer utilities on Linux systems. Attackers may use these utilities to exfiltrate data from a compromised system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Exfiltration], [Tactic: Execution], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<unusual-group-name-accessed-by-a-user, Unusual Group Name Accessed by a User>> |A machine learning job has detected a user accessing an uncommon group name for privileged operations, indicating potential privileged access activity. This indicates that a user has accessed a group name that is unusual for their typical operations, particularly for actions requiring elevated privileges. This could point to an attempt to manipulate group memberships or escalate privileges on a system. |[Use Case: Privileged Access Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Privilege Escalation], [Resources: Investigation Guide] |None |3
 
@@ -2828,7 +2828,7 @@ and their rule type is `machine_learning`.
 
 |<<unusual-process-spawned-by-a-user, Unusual Process Spawned by a User>> |A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |110
 
-|<<unusual-process-spawned-from-web-server-parent, Unusual Process Spawned from Web Server Parent>> |This rule detects unusual processes spawned from a web server parent process by identifying low frequency counts of process spawning activity. Unusual process spawning activity may indicate an attacker attempting to establish persistence, execute malicious commands, or establish command and control channels on the host system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |5
+|<<unusual-process-spawned-from-web-server-parent, Unusual Process Spawned from Web Server Parent>> |This rule detects unusual processes spawned from a web server parent process by identifying low frequency counts of process spawning activity. Unusual process spawning activity may indicate an attacker attempting to establish persistence, execute malicious commands, or establish command and control channels on the host system. ESQL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |6
 
 |<<unusual-process-writing-data-to-an-external-device, Unusual Process Writing Data to an External Device>> |A machine learning job has detected a rare process writing data to an external device. Malicious actors often use benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no legitimate reason to write data to external devices can indicate exfiltration. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration], [Resources: Investigation Guide] |None |7
 
@@ -2900,7 +2900,7 @@ and their rule type is `machine_learning`.
 
 |<<user-detected-with-suspicious-windows-process-es, User Detected with Suspicious Windows Process(es)>> |A machine learning job combination has identified a user with one or more suspicious Windows processes that exhibit unusually high malicious probability scores. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion], [Resources: Investigation Guide] |None |110
 
-|<<user-account-exposed-to-kerberoasting, User account exposed to Kerberoasting>> |Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Windows Security Event Logs] |None |217
+|<<user-account-exposed-to-kerberoasting, User account exposed to Kerberoasting>> |Detects when a user account has the servicePrincipalName attribute modified. Attackers can abuse write privileges over a user to configure Service Principle Names (SPNs) so that they can perform Kerberoasting. Administrators can also configure this for legitimate purposes, exposing the account to Kerberoasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Windows Security Event Logs] |None |218
 
 |<<user-or-group-creation-modification, User or Group Creation/Modification>> |This rule leverages the `auditd_manager` integration to detect user or group creation or modification events on Linux systems. Threat actors may attempt to create or modify users or groups to establish persistence on the system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Auditd Manager], [Resources: Investigation Guide] |None |6
 
@@ -2942,7 +2942,7 @@ and their rule type is `machine_learning`.
 
 |<<web-server-spawned-via-python, Web Server Spawned via Python>> |This rule identifies when a web server is spawned via Python. Attackers may use Python to spawn a web server to exfiltrate/infiltrate data or to move laterally within a network. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Crowdstrike], [Data Source: SentinelOne], [Data Source: Elastic Endgame], [Resources: Investigation Guide] |None |105
 
-|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: Crowdstrike] |None |419
+|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: SentinelOne], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: Crowdstrike] |None |420
 
 |<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Resources: Investigation Guide] |None |210
 
@@ -2958,11 +2958,11 @@ and their rule type is `machine_learning`.
 
 |<<windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> |Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint] |None |217
 
-|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |316
+|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |317
 
 |<<windows-event-logs-cleared, Windows Event Logs Cleared>> |Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Windows Security Event Logs], [Data Source: Windows System Event Logs] |None |215
 
-|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |314
+|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Windows Security Event Logs], [Data Source: Microsoft Defender for Endpoint], [Data Source: Sysmon], [Data Source: SentinelOne], [Data Source: Crowdstrike] |None |315
 
 |<<windows-installer-with-suspicious-properties, Windows Installer with Suspicious Properties>> |Identifies the execution of an installer from an archive or with suspicious properties. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files in an attempt to bypass application whitelisting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |None |4
 
@@ -2978,7 +2978,7 @@ and their rule type is `machine_learning`.
 
 |<<windows-script-interpreter-executing-process-via-wmi, Windows Script Interpreter Executing Process via WMI>> |Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Resources: Investigation Guide] |None |213
 
-|<<windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> |Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |216
+|<<windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> |Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Windows Security Event Logs], [Resources: Investigation Guide] |None |217
 
 |<<windows-subsystem-for-linux-distribution-installed, Windows Subsystem for Linux Distribution Installed>> |Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon], [Data Source: Microsoft Defender for Endpoint], [Data Source: SentinelOne], [Data Source: Crowdstrike], [Resources: Investigation Guide] |None |212
 
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 607d28a974..34c8d7ba27 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -35,6 +35,7 @@ include::rule-details/aws-ec2-instance-interaction-with-iam-service.asciidoc[]
 include::rule-details/aws-ec2-multi-region-describeinstances-api-calls.asciidoc[]
 include::rule-details/aws-ec2-network-access-control-list-creation.asciidoc[]
 include::rule-details/aws-ec2-network-access-control-list-deletion.asciidoc[]
+include::rule-details/aws-ec2-route-table-created.asciidoc[]
 include::rule-details/aws-ec2-route-table-modified-or-deleted.asciidoc[]
 include::rule-details/aws-ec2-security-group-configuration-change.asciidoc[]
 include::rule-details/aws-ec2-unauthorized-admin-credential-fetch-via-assumed-role.asciidoc[]
@@ -90,7 +91,6 @@ include::rule-details/aws-redshift-cluster-creation.asciidoc[]
 include::rule-details/aws-root-login-without-mfa.asciidoc[]
 include::rule-details/aws-route-53-domain-transfer-lock-disabled.asciidoc[]
 include::rule-details/aws-route-53-domain-transferred-to-another-account.asciidoc[]
-include::rule-details/aws-route-table-created.asciidoc[]
 include::rule-details/aws-route53-private-hosted-zone-associated-with-a-vpc.asciidoc[]
 include::rule-details/aws-s3-bucket-configuration-deletion.asciidoc[]
 include::rule-details/aws-s3-bucket-enumeration-or-brute-force.asciidoc[]
@@ -102,10 +102,12 @@ include::rule-details/aws-s3-object-encryption-using-external-kms-key.asciidoc[]
 include::rule-details/aws-s3-object-versioning-suspended.asciidoc[]
 include::rule-details/aws-s3-static-site-javascript-file-uploaded.asciidoc[]
 include::rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc[]
-include::rule-details/aws-sns-email-subscription-by-rare-user.asciidoc[]
+include::rule-details/aws-sns-rare-protocol-subscription-by-user.asciidoc[]
 include::rule-details/aws-sns-topic-created-by-rare-user.asciidoc[]
+include::rule-details/aws-sns-topic-message-publish-by-rare-user.asciidoc[]
 include::rule-details/aws-sqs-queue-purge.asciidoc[]
 include::rule-details/aws-ssm-command-document-created-by-rare-user.asciidoc[]
+include::rule-details/aws-ssm-session-started-to-ec2-instance.asciidoc[]
 include::rule-details/aws-ssm-sendcommand-execution-by-rare-user.asciidoc[]
 include::rule-details/aws-ssm-sendcommand-with-run-shell-command-parameters.asciidoc[]
 include::rule-details/aws-sts-assumerole-with-new-mfa-device.asciidoc[]
@@ -290,6 +292,7 @@ include::rule-details/default-cobalt-strike-team-server-certificate.asciidoc[]
 include::rule-details/delayed-execution-via-ping.asciidoc[]
 include::rule-details/delegated-managed-service-account-modification-by-an-unusual-user.asciidoc[]
 include::rule-details/delete-volume-usn-journal-with-fsutil.asciidoc[]
+include::rule-details/deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc[]
 include::rule-details/deprecated-launchdaemon-creation-or-modification-and-immediate-loading.asciidoc[]
 include::rule-details/directory-creation-in-bin-directory.asciidoc[]
 include::rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[]
@@ -350,7 +353,6 @@ include::rule-details/execution-from-unusual-directory-command-line.asciidoc[]
 include::rule-details/execution-from-a-removable-media-with-network-connection.asciidoc[]
 include::rule-details/execution-of-com-object-via-xwizard.asciidoc[]
 include::rule-details/execution-of-file-written-or-modified-by-microsoft-office.asciidoc[]
-include::rule-details/execution-of-file-written-or-modified-by-pdf-reader.asciidoc[]
 include::rule-details/execution-of-persistent-suspicious-program.asciidoc[]
 include::rule-details/execution-of-a-downloaded-windows-script.asciidoc[]
 include::rule-details/execution-of-an-unsigned-service.asciidoc[]
@@ -788,7 +790,6 @@ include::rule-details/potential-credential-access-via-renamed-com-services-dll.a
 include::rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc[]
 include::rule-details/potential-credential-access-via-windows-utilities.asciidoc[]
 include::rule-details/potential-dga-activity.asciidoc[]
-include::rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
 include::rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc[]
 include::rule-details/potential-dns-tunneling-via-nslookup.asciidoc[]
 include::rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc[]
@@ -961,7 +962,7 @@ include::rule-details/potential-windows-session-hijacking-via-ccmexec.asciidoc[]
 include::rule-details/potential-curl-cve-2023-38545-exploitation.asciidoc[]
 include::rule-details/potential-macos-ssh-brute-force-detected.asciidoc[]
 include::rule-details/potential-privilege-escalation-via-cve-2022-38028.asciidoc[]
-include::rule-details/potentially-successful-mfa-bombing-via-push-notifications.asciidoc[]
+include::rule-details/potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc[]
 include::rule-details/potentially-suspicious-process-started-via-tmux-or-screen.asciidoc[]
 include::rule-details/powershell-invoke-ninjacopy-script.asciidoc[]
 include::rule-details/powershell-kerberos-ticket-dump.asciidoc[]
@@ -1076,13 +1077,11 @@ include::rule-details/sip-provider-modification.asciidoc[]
 include::rule-details/smb-windows-file-sharing-activity-to-the-internet.asciidoc[]
 include::rule-details/smb-connections-via-lolbin-or-untrusted-process.asciidoc[]
 include::rule-details/smtp-on-port-26-tcp.asciidoc[]
-include::rule-details/sns-topic-message-publish-by-rare-user.asciidoc[]
 include::rule-details/ssh-authorized-keys-file-deletion.asciidoc[]
 include::rule-details/ssh-authorized-keys-file-modification.asciidoc[]
 include::rule-details/ssh-key-generated-via-ssh-keygen.asciidoc[]
 include::rule-details/ssh-process-launched-from-inside-a-container.asciidoc[]
 include::rule-details/ssl-certificate-deletion.asciidoc[]
-include::rule-details/ssm-session-started-to-ec2-instance.asciidoc[]
 include::rule-details/suid-sgid-bit-set.asciidoc[]
 include::rule-details/suid-sguid-enumeration-detected.asciidoc[]
 include::rule-details/sunburst-command-and-control-activity.asciidoc[]
@@ -1221,6 +1220,7 @@ include::rule-details/suspicious-managed-code-hosting-process.asciidoc[]
 include::rule-details/suspicious-memory-grep-activity.asciidoc[]
 include::rule-details/suspicious-microsoft-365-mail-access-by-unusual-clientappid.asciidoc[]
 include::rule-details/suspicious-microsoft-365-userloggedin-via-oauth-code.asciidoc[]
+include::rule-details/suspicious-microsoft-antimalware-service-execution.asciidoc[]
 include::rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc[]
 include::rule-details/suspicious-microsoft-html-application-child-process.asciidoc[]
 include::rule-details/suspicious-microsoft-oauth-flow-via-auth-broker-to-drs.asciidoc[]
@@ -1280,7 +1280,7 @@ include::rule-details/symbolic-link-to-shadow-copy-created.asciidoc[]
 include::rule-details/system-binary-moved-or-copied.asciidoc[]
 include::rule-details/system-binary-path-file-permission-modification.asciidoc[]
 include::rule-details/system-binary-symlink-to-suspicious-location.asciidoc[]
-include::rule-details/system-file-onwership-change.asciidoc[]
+include::rule-details/system-file-ownership-change.asciidoc[]
 include::rule-details/system-hosts-file-access.asciidoc[]
 include::rule-details/system-information-discovery-via-windows-command-shell.asciidoc[]
 include::rule-details/system-log-file-deletion.asciidoc[]
@@ -1355,7 +1355,7 @@ include::rule-details/unusual-execution-via-microsoft-common-console-file.asciid
 include::rule-details/unusual-exim4-child-process.asciidoc[]
 include::rule-details/unusual-file-creation-alternate-data-stream.asciidoc[]
 include::rule-details/unusual-file-creation-by-web-server.asciidoc[]
-include::rule-details/unusual-file-modification-by-dns-exe.asciidoc[]
+include::rule-details/unusual-file-operation-by-dns-exe.asciidoc[]
 include::rule-details/unusual-file-transfer-utility-launched.asciidoc[]
 include::rule-details/unusual-group-name-accessed-by-a-user.asciidoc[]
 include::rule-details/unusual-high-confidence-content-filter-blocks-detected.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-access-token-used-from-multiple-addresses.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-access-token-used-from-multiple-addresses.asciidoc
index b036f387eb..0b132feba8 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-access-token-used-from-multiple-addresses.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-access-token-used-from-multiple-addresses.asciidoc
@@ -32,7 +32,7 @@ This rule identifies potentially suspicious activity by detecting instances wher
 * Use Case: Identity and Access Audit
 * Resources: Investigation Guide
 
-*Version*: 102
+*Version*: 103
 
 *Rule authors*: 
 
@@ -101,16 +101,20 @@ from logs-aws.cloudtrail* metadata _id, _version, _index
   and aws.cloudtrail.user_identity.arn is not null
   and aws.cloudtrail.user_identity.type == "IAMUser"
   and source.ip is not null
+  and aws.cloudtrail.user_identity.access_key_id is not null
   and not (
-    user_agent.original like "%Terraform%" or
-    user_agent.original like "%Ansible%" or
-    user_agent.original like "%Pulumni%"
+    user_agent.original like "*Terraform*" or
+    user_agent.original like "*Ansible*" or
+    user_agent.original like "*Pulumi*"
   )
   and `source.as.organization.name` != "AMAZON-AES"
+  and not ((
+    `source.as.organization.name` == "AMAZON-02" and aws.cloudtrail.event_category == "Data"))
   and event.provider not in (
     "health.amazonaws.com", "monitoring.amazonaws.com", "notifications.amazonaws.com",
     "ce.amazonaws.com", "cost-optimization-hub.amazonaws.com",
-    "servicecatalog-appregistry.amazonaws.com", "securityhub.amazonaws.com"
+    "servicecatalog-appregistry.amazonaws.com", "securityhub.amazonaws.com", 
+    "account.amazonaws.com", "budgets.amazonaws.com", "freetier.amazonaws.com"
   )
 
 | eval
@@ -123,8 +127,9 @@ from logs-aws.cloudtrail* metadata _id, _version, _index
   Esql.source_ip_user_agent_pair = concat(Esql.source_ip_string, " - ", user_agent.original),
   Esql.source_ip_city_pair = concat(Esql.source_ip_string, " - ", source.geo.city_name),
   Esql.source_geo_city_name = source.geo.city_name,
-  Esql.event_timestamp = @timestamp,
-  Esql.source_network_org_name = `source.as.organization.name`
+  Esql.source_network_org_name = `source.as.organization.name`,
+  Esql.source_ip_network_pair = concat(Esql.source_ip_string, "-", `source.as.organization.name`),
+  Esql.event_timestamp = @timestamp
 
 | stats
   Esql.event_action_values = values(event.action),
@@ -137,6 +142,7 @@ from logs-aws.cloudtrail* metadata _id, _version, _index
   Esql.source_geo_city_name_values = values(Esql.source_geo_city_name),
   Esql.source_ip_city_pair_values = values(Esql.source_ip_city_pair),
   Esql.source_network_org_name_values = values(Esql.source_network_org_name),
+  Esql.source_ip_network_pair_values = values(Esql.source_ip_network_pair),
   Esql.source_ip_count_distinct = count_distinct(Esql.source_ip),
   Esql.user_agent_original_count_distinct = count_distinct(Esql.user_agent_original),
   Esql.source_geo_city_name_count_distinct = count_distinct(Esql.source_geo_city_name),
@@ -180,6 +186,7 @@ from logs-aws.cloudtrail* metadata _id, _version, _index
   Esql.source_geo_city_name_values,
   Esql.source_ip_city_pair_values,
   Esql.source_network_org_name_values,
+  Esql.source_ip_network_pair_values,
   Esql.source_ip_count_distinct,
   Esql.user_agent_original_count_distinct,
   Esql.source_geo_city_name_count_distinct,
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-scan-by-unusual-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-scan-by-unusual-user.asciidoc
index 2ca9908c5a..4767bd7cab 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-scan-by-unusual-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-scan-by-unusual-user.asciidoc
@@ -1,7 +1,7 @@
 [[aws-dynamodb-scan-by-unusual-user]]
 === AWS DynamoDB Scan by Unusual User
 
-Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by the `aws.cloudtrail.user_identity.arn` for the first time in the last 14 days.
+Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
 
 *Rule type*: new_terms
 
@@ -16,7 +16,7 @@ Identifies when an AWS DynamoDB table is scanned by a user who does not typicall
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
@@ -34,7 +34,7 @@ Identifies when an AWS DynamoDB table is scanned by a user who does not typicall
 * Use Case: Threat Detection
 * Tactic: Exfiltration
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -56,14 +56,14 @@ Identifies when an AWS DynamoDB table is scanned by a user who does not typicall
 
 This rule identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs.
 
-This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time on a host in the last 14 days.
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time.
 
 
 *Possible Investigation Steps*
 
 
 - Identify the Actor: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
-- Review the Source IP: Check the `source.address` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
+- Review the Source IP: Check the `source.ip` field to determine the source of the request. If the request comes from an unexpected location or IP address, it may indicate a compromised account or unauthorized access.
 - Analyze the Request Parameters: Examine the `aws.cloudtrail.request_parameters` field to understand the details of the Scan request. Look for any unusual parameters or patterns that may indicate malicious intent. This also details the DynamoDB table being scanned.
 - Review Access Key: Check the `aws.cloudtrail.user_identity.access_key_id` field to identify the access key used for the request. Determine if this key is associated with a legitimate user or if it has been compromised.
 
@@ -88,7 +88,7 @@ This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#
 *Additional Information*
 
 
-For further guidance on managing and securing SNS topics in AWS environments, refer to the https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html[AWS SNS documentation] and AWS best practices for security.
+For further guidance on managing and securing DynamoDB in AWS environments, refer to the https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html[AWS DynamoDB documentation] and AWS best practices for security.
 
 
 ==== Setup
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-table-exported-to-s3.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-table-exported-to-s3.asciidoc
index 306cebc939..ac4838e022 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-table-exported-to-s3.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-dynamodb-table-exported-to-s3.asciidoc
@@ -1,7 +1,7 @@
 [[aws-dynamodb-table-exported-to-s3]]
 === AWS DynamoDB Table Exported to S3
 
-Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by the "user.name" for the first time.
+Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
 
 *Rule type*: new_terms
 
@@ -34,7 +34,7 @@ Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the
 * Use Case: Threat Detection
 * Tactic: Exfiltration
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -85,11 +85,6 @@ This is a New Terms rule that only flags when this behavior is observed for the
 For further guidance on managing and securing DynamoDB in AWS environments, refer to the https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/security.html[AWS DynamoDB documentation] and AWS best practices for security.
 
 
-==== Setup
-
-
-DynamoDB data events must be enabled in CloudTrail to capture the ExportTableToPointInTime actions. Ensure that the AWS CloudTrail service is configured to log data events for DynamoDB tables.
-
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
index 158199036f..85627549ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-instance-connect-ssh-public-key-uploaded.asciidoc
@@ -1,7 +1,7 @@
 [[aws-ec2-instance-connect-ssh-public-key-uploaded]]
 === AWS EC2 Instance Connect SSH Public Key Uploaded
 
-Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule also detects the `SendSerialConsoleSSHPublicKey` or `SendSSHPublicKey` API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console.
+Identifies when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. This action could indicate an adversary attempting to maintain access to the instance. The rule detects the SendSerialConsoleSSHPublicKey or SendSSHPublicKey API actions, which are logged when manually uploading an SSH key to an EC2 instance or serial connection. It is important to know that this API call happens automatically by the EC2 Instance Connect service when a user connects to an EC2 instance using the EC2 Instance Connect service via the CLI or AWS Management Console.
 
 *Rule type*: query
 
@@ -16,15 +16,16 @@ Identifies when a new SSH public key is uploaded to an AWS EC2 instance using th
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
 *References*: 
 
+* https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques
+* https://medium.parttimepolymath.net/aws-ec2-instance-connect-a-very-neat-trick-4d2fc0c28010
 * https://stratus-red-team.cloud/attack-techniques/AWS/aws.lateral-movement.ec2-instance-connect/
 * https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc
-* https://medium.parttimepolymath.net/aws-ec2-instance-connect-a-very-neat-trick-4d2fc0c28010
 * https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSSHPublicKey.html
 * https://docs.aws.amazon.com/ec2-instance-connect/latest/APIReference/API_SendSerialConsoleSSHPublicKey.html
 
@@ -39,7 +40,7 @@ Identifies when a new SSH public key is uploaded to an AWS EC2 instance using th
 * Tactic: Lateral Movement
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -59,14 +60,14 @@ Identifies when a new SSH public key is uploaded to an AWS EC2 instance using th
 *Investigating AWS EC2 Instance Connect SSH Public Key Uploaded*
 
 
-This rule detects when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. Adversaries may upload SSH public keys to EC2 instances to maintain access to the instance or for initial access. This action also occurs automatically in the background when establishing a connection to an instance via the same service.  The rule also covers cases where the `SendSerialConsoleSSHPublicKey` API action is used to upload an SSH public key to a serial connection, which can be exploited for privilege escalation.
+This rule detects when a new SSH public key is uploaded to an AWS EC2 instance using the EC2 Instance Connect service. Adversaries may upload SSH public keys to EC2 instances to maintain access to the instance or for initial access. This action also occurs automatically in the background when establishing a connection to an instance via the same service.  The rule covers cases where the `SendSerialConsoleSSHPublicKey` API action is used to upload an SSH public key to a serial connection, which can be exploited for privilege escalation.
 
 
 *Possible Investigation Steps:*
 
 
 - **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions.
-- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the SSH public key upload. Look for any unusual parameters that could suggest unauthorized or malicious modifications.
+- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific details of the SSH public key upload. Look for any unusual parameters that could suggest unauthorized or malicious modifications. Use the `target.entity.id` field to determine the targeted EC2 instance.
 - **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
 - **Contextualize with Timestamp**: Use the `@timestamp` field to check when the SSH public key was uploaded. Changes during non-business hours or outside regular maintenance windows might require further scrutiny.
 - **Correlate with Other Activities**: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
@@ -78,7 +79,7 @@ This rule detects when a new SSH public key is uploaded to an AWS EC2 instance u
 
 - **Legitimate Administrative Actions**: Confirm if the SSH public key upload aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
 - **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
-- **Verify through Outcomes**: Check the `aws.cloudtrail.response_elements` and the `event.outcome` to confirm if the upload was successful and intended according to policy.
+
 
 
 *Response and Remediation:*
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-created.asciidoc
new file mode 100644
index 0000000000..23f023bd69
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-created.asciidoc
@@ -0,0 +1,121 @@
+[[aws-ec2-route-table-created]]
+=== AWS EC2 Route Table Created
+
+Identifies when an EC2 Route Table has been created. Route tables can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.datadoghq.com/security_platform/default_rules/aws-ec2-route-table-modified/
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html
+* https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS EC2
+* Use Case: Network Security Monitoring
+* Tactic: Persistence
+* Resources: Investigation Guide
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating AWS EC2 Route Table Created*
+
+
+AWS Route Tables are crucial components in managing network traffic within AWS environments, directing data between subnets and internet gateways. Adversaries may exploit route tables to reroute traffic for data exfiltration or to establish persistence by creating unauthorized routes. The detection rule monitors successful creation events of route tables, flagging potential misuse by correlating specific AWS CloudTrail logs, thus aiding in identifying unauthorized network configuration changes.
+
+
+*Possible investigation steps*
+
+
+- Investigate the AWS account and IAM user or role to determine if the action aligns with expected behavior and permissions.
+- Examine the newly created route table's configuration to identify any unauthorized or suspicious routes that could indicate potential misuse or data exfiltration attempts.
+- Correlate the event with other network security monitoring data to identify any unusual traffic patterns or anomalies that coincide with the route table creation.
+- Assess the environment for any recent changes or incidents that might explain the creation of the route table, such as new deployments or infrastructure modifications.
+
+
+*False positive analysis*
+
+
+- Routine infrastructure updates or deployments may trigger route table creation events. To manage this, establish a baseline of expected behavior during scheduled maintenance windows and exclude these from alerts.
+- Automated cloud management tools often create route tables as part of their operations. Identify these tools and create exceptions for their known activities to reduce noise.
+- Development and testing environments frequently undergo changes, including the creation of route tables. Consider excluding these environments from alerts or applying a different set of monitoring rules.
+- Legitimate changes by authorized personnel can be mistaken for suspicious activity. Implement a process to verify and document authorized changes, allowing for quick exclusion of these events from alerts.
+- Multi-account AWS setups might have centralized networking teams that create route tables across accounts. Coordinate with these teams to understand their activities and exclude them from triggering alerts.
+
+
+*Response and remediation*
+
+
+- If unauthorized, remove permissions for related actions from the user or role. You can use the managed https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html[AWSDenyAll] policy. 
+- Review the newly created route table and any associated routes to identify unauthorized entries. Remove any routes that are not part of the expected network configuration.
+- Conduct a thorough audit of IAM roles and permissions to ensure that only authorized users have the ability to create or modify route tables. Revoke any excessive permissions identified.
+- Implement network monitoring to detect unusual traffic patterns that may indicate data exfiltration or other malicious activities.
+- Escalate the incident to the security operations team for further investigation and to determine if additional AWS resources have been compromised.
+- Review AWS CloudTrail logs for any other suspicious activities around the time of the route table creation to identify potential indicators of compromise.
+- Update security policies and procedures to include specific guidelines for monitoring and responding to unauthorized route table modifications, ensuring rapid detection and response in the future.
+
+==== Setup
+
+
+The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "ec2.amazonaws.com" 
+    and event.action:(
+        "CreateRoute" or 
+        "CreateRouteTable"
+    ) 
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-modified-or-deleted.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-modified-or-deleted.asciidoc
index 857cfb1ee5..9cecbcf94e 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-modified-or-deleted.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ec2-route-table-modified-or-deleted.asciidoc
@@ -1,7 +1,7 @@
 [[aws-ec2-route-table-modified-or-deleted]]
 === AWS EC2 Route Table Modified or Deleted
 
-Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule that detects the first instance of this behavior by the `aws.cloudtrail.user_identity.arn` field in the last 10 days.
+Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role.
 
 *Rule type*: new_terms
 
@@ -16,7 +16,7 @@ Identifies AWS CloudTrail events where an EC2 route table or association has bee
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
@@ -40,7 +40,7 @@ Identifies AWS CloudTrail events where an EC2 route table or association has bee
 * Resources: Investigation Guide
 * Tactic: Persistence
 
-*Version*: 210
+*Version*: 211
 
 *Rule authors*: 
 
@@ -68,7 +68,7 @@ This rule detects modifications or deletions of AWS route tables using actions s
 
 
 - **Review Request Parameters:**
-   - Check the `aws.cloudtrail.flattened.request_parameters` field. The sub-fields may vary depending on the `event.action` (e.g., `routeTableId` for `DeleteRouteTable`, `destinationCidrBlock` for `ReplaceRoute`).
+   - Check the `aws.cloudtrail.request_parameters` field. The sub-fields may vary depending on the `event.action` (e.g., `routeTableId` for `DeleteRouteTable`, `destinationCidrBlock` for `ReplaceRoute`).
    - Validate the affected route table, routes, or associations based on the API call:
      - For `ReplaceRoute`: Look for changes in specific routes using `destinationCidrBlock`.
      - For `ReplaceRouteTableAssociation`: Review the new association details (e.g., subnet ID).
@@ -82,7 +82,7 @@ This rule detects modifications or deletions of AWS route tables using actions s
 
 - **Analyze Request Details**:
   - **Action Type**: Verify the specific API call in the `event.action` field (e.g., `ReplaceRoute`, `DeleteRouteTable`) to understand the nature of the modification.
-  - **Source IP and Geolocation**: Examine the `source.address` and `source.geo` fields to confirm whether the request originated from a trusted location. Suspicious geolocations or IPs may indicate adversarial activity.
+  - **Source IP and Geolocation**: Examine the `source.ip` and `source.geo` fields to confirm whether the request originated from a trusted location. Suspicious geolocations or IPs may indicate adversarial activity.
   - **User Agent**: Review the `user_agent.original` field to determine the tool used for the request (e.g., AWS CLI, Terraform). Unusual or custom user agents may indicate malicious intent.
 
 - **Correlate with Other Activity**:
@@ -106,7 +106,7 @@ This rule detects modifications or deletions of AWS route tables using actions s
 *Response and Remediation*
 
 
-- **Revoke Unauthorized Permissions**: If unauthorized, remove permissions for `ec2:ReplaceRoute`, `ec2:DeleteRouteTable`, or other related actions from the user or role.
+- **Revoke Unauthorized Permissions**: If unauthorized, remove permissions for related actions from the user or role. You can use the managed https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSDenyAll.html[AWSDenyAll] policy.
 - **Restore the Route Table**:
   - If critical networking was impacted, restore the route table or reapply previous configurations from backups or Terraform state files.
   - Verify connectivity to affected subnets or instances to ensure no disruptions to services.
@@ -134,11 +134,6 @@ event.dataset: "aws.cloudtrail"
         "DisassociateRouteTable"
     )
     and event.outcome: "success"
-    and not source.address: (
-        "cloudformation.amazonaws.com" or
-        "servicecatalog.amazonaws.com" or
-        "fsx.amazonaws.com"
-    )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
index 7de678fabf..112e33df43 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-create-user-via-assumed-role-on-ec2-instance.asciidoc
@@ -1,7 +1,7 @@
 [[aws-iam-create-user-via-assumed-role-on-ec2-instance]]
 === AWS IAM Create User via Assumed Role on EC2 Instance
 
-Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles—particularly from within EC2 instances—may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
+Detects the creation of an AWS Identity and Access Management (IAM) user initiated by an assumed role on an EC2 instance. Assumed roles allow users or services to temporarily adopt different AWS permissions, but the creation of IAM users through these roles, particularly from within EC2 instances, may indicate a compromised instance. Adversaries might exploit such permissions to establish persistence by creating new IAM users under unauthorized conditions.
 
 *Rule type*: new_terms
 
@@ -16,7 +16,7 @@ Detects the creation of an AWS Identity and Access Management (IAM) user initiat
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
@@ -35,7 +35,7 @@ Detects the creation of an AWS Identity and Access Management (IAM) user initiat
 * Tactic: Persistence
 * Resources: Investigation Guide
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -63,15 +63,14 @@ This rule detects when an AWS Identity and Access Management (IAM) user is creat
 
 - **Identify the Assumed Role and Initiating Instance**:
   - **Role and Instance**: Examine the `aws.cloudtrail.user_identity.arn` field to determine the specific EC2 instance and role used for this action (e.g., `arn:aws:sts::[account-id]:assumed-role/[role-name]/[instance-id]`). Verify if this behavior aligns with expected usage or represents an anomaly.
-  - **Session Context**: Check the `session_issuer` fields in `aws.cloudtrail.user_identity.session_context` for details about the role assumed by the instance, along with `mfa_authenticated` to determine if Multi-Factor Authentication (MFA) was used.
 
 - **Analyze the Target IAM User**:
-  - **New User Details**: Inspect `aws.cloudtrail.flattened.request_parameters.userName` to see the username that was created. Look at `aws.cloudtrail.flattened.response_elements.user.userName` for confirmation of successful user creation, and validate if the user is expected or authorized.
+  - **New User Details**: Inspect `aws.cloudtrail.request_parameters` to see the username that was created. Validate if the user is expected or authorized.
   - **Review Creation Time and Context**: Compare the creation time (`@timestamp`) of the user with other activities from the same instance and role to assess if this creation was part of a larger chain of actions.
 
 - **Check User Agent and Tooling**:
   - **User Agent Analysis**: Review `user_agent.original` to see if AWS CLI, SDK, or other tooling was used for this request. Identifiers such as `aws-cli`, `boto3`, or similar SDK names can indicate the method used, which may differentiate automation from interactive actions.
-  - **Source IP and Location**: Use the `source.address` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.
+  - **Source IP and Location**: Use the `source.ip` and `source.geo` fields to identify the IP address and geographic location of the event. Verify if this aligns with expected access patterns for your environment.
 
 - **Evaluate for Persistence Indicators**:
   - **Role Permissions**: Check the permissions associated with the assumed role (`arn:aws:iam::[account-id]:role/[role-name]`) to determine if creating IAM users is a legitimate activity for this role.
@@ -86,7 +85,7 @@ This rule detects when an AWS Identity and Access Management (IAM) user is creat
 
 
 - **Expected Automation**: Assumed roles may be used by legitimate automated systems that create users for specific workflows. Confirm if this event aligns with known automation activities.
-- **User Agent and Role Exceptions**: If this action is routine for specific roles or user agents (e.g., `aws-cli`, `boto3`), consider adding those roles or user agents to a monitored exception list for streamlined review.
+- **Role Exceptions**: If this action is routine for specific roles, consider adding those roles to a monitored exception list for streamlined review.
 
 
 *Response and Remediation*
@@ -114,7 +113,7 @@ event.dataset: "aws.cloudtrail"
     and event.action: "CreateUser"
     and event.outcome: "success"
     and aws.cloudtrail.user_identity.type: "AssumedRole"
-    and aws.cloudtrail.user_identity.arn: *i-*
+    and user.id: *\:i-*
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
index 828aa654d9..b18acc03ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-iam-customer-managed-policy-attached-to-role-by-rare-user.asciidoc
@@ -7,7 +7,6 @@ Detects when an AWS Identity and Access Management (IAM) customer-managed policy
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-aws.cloudtrail-*
 
 *Severity*: low
@@ -34,7 +33,7 @@ Detects when an AWS Identity and Access Management (IAM) customer-managed policy
 * Use Case: Identity and Access Audit
 * Tactic: Privilege Escalation
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
index 3901501648..38bc132aaf 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-s3-unauthenticated-bucket-access-by-rare-source.asciidoc
@@ -1,7 +1,7 @@
 [[aws-s3-unauthenticated-bucket-access-by-rare-source]]
 === AWS S3 Unauthenticated Bucket Access by Rare Source
 
-Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify `--no-sign-request` in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a [New Terms](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule) rule, which means it will only trigger once for each unique value of the `source.address` field that has not been seen making this API request within the last 7 days. This field contains the IP address of the source making the request.
+Identifies AWS CloudTrail events where an unauthenticated source is attempting to access an S3 bucket. This activity may indicate a misconfigured S3 bucket policy that allows public access to the bucket, potentially exposing sensitive data to unauthorized users. Adversaries can specify --no-sign-request in the AWS CLI to retrieve objects from an S3 bucket without authentication. This is a New Terms rule, which means it will trigger for each unique combination of the source.address and targeted bucket name that has not been seen making this API request.
 
 *Rule type*: new_terms
 
@@ -16,7 +16,7 @@ Identifies AWS CloudTrail events where an unauthenticated source is attempting t
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
@@ -34,7 +34,7 @@ Identifies AWS CloudTrail events where an unauthenticated source is attempting t
 * Resources: Investigation Guide
 * Tactic: Collection
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -57,45 +57,6 @@ Identifies AWS CloudTrail events where an unauthenticated source is attempting t
 *Investigating AWS S3 Unauthenticated Bucket Access by Rare Source*
 
 
-Amazon S3 is a scalable storage service used for data storage and retrieval. Misconfigured bucket policies can inadvertently allow public access, posing a risk of unauthorized data exposure. Adversaries exploit this by using unauthenticated requests to access data. The detection rule identifies unusual access attempts from new IP addresses, signaling potential misuse and prompting further investigation.
-
-
-*Possible investigation steps*
-
-
-- Review the CloudTrail logs to identify the specific S3 bucket involved in the unauthenticated access attempt and determine the nature of the accessed data.
-- Examine the source IP address from the `source.address` field to assess its origin and determine if it is associated with known malicious activity or if it is a legitimate but misconfigured source.
-- Check the S3 bucket policy and permissions to identify any misconfigurations that might allow public access, focusing on policies that include "Principal": "*".
-- Investigate the `aws.cloudtrail.user_identity.type` field to confirm if the access was made by an "AWSAccount" or "Unknown" identity, and determine if this aligns with expected behavior.
-- Assess the `event.action` field to understand the type of operation performed (e.g., "GetObject", "PutObject") and evaluate the potential impact of the access.
-- Review recent changes to the S3 bucket configuration or IAM policies that might have inadvertently allowed public access, and correlate these with the timing of the alert.
-- If unauthorized access is confirmed, take immediate steps to secure the bucket by updating the bucket policy to restrict access and consider enabling logging and monitoring for future access attempts.
-
-
-*False positive analysis*
-
-
-- Frequent access from known internal IP addresses may trigger the rule. To manage this, create exceptions for IP addresses that are part of your organization's network and regularly access S3 buckets without authentication.
-- Automated scripts or tools used for legitimate business processes might use unauthenticated requests. Identify these scripts and exclude their IP addresses from triggering the rule by adding them to an allowlist.
-- Third-party services that require access to your S3 buckets might appear as unauthenticated sources. Verify these services and, if deemed safe, exclude their IP addresses from the rule to prevent false positives.
-- Temporary testing environments or development setups might use unauthenticated access for convenience. Ensure these environments are documented and their IP addresses are excluded from the rule to avoid unnecessary alerts.
-
-
-*Response and remediation*
-
-
-- Immediately revoke public access to the affected S3 bucket by updating the bucket policy to restrict access to only authorized users and roles.
-- Identify and terminate any unauthorized sessions or connections from the IP addresses flagged in the alert to prevent further unauthorized access.
-- Conduct a thorough review of the S3 bucket's access logs to determine the extent of data exposure and identify any sensitive data that may have been accessed.
-- Notify the security team and relevant stakeholders about the potential data exposure incident and provide them with details of the affected resources and actions taken.
-- Implement additional monitoring and alerting for unusual access patterns to S3 buckets, focusing on unauthenticated access attempts and access from rare IP addresses.
-- Escalate the incident to the organization's incident response team for further investigation and to determine if additional containment or remediation actions are necessary.
-- Review and update the organization's cloud security policies and access controls to prevent similar misconfigurations in the future, ensuring that all S3 buckets have appropriate access restrictions.
-
-
-*Investigating AWS S3 Unauthenticated Bucket Access by Rare Source*
-
-
 This rule detects requests to an AWS S3 bucket by an unauthenticated source, which could indicate a misconfigured bucket policy allowing public access. Adversaries can exploit this misconfiguration by using tools or AWS CLI options like `--no-sign-request` to access bucket contents.
 
 The rule triggers when an unauthenticated IP address retrieves an object, and that IP has not been seen in the last 7 days.
@@ -169,6 +130,11 @@ The rule triggers when an unauthenticated IP address retrieves an object, and th
 - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html[AWS S3 Block Public Access]
 
 
+==== Setup
+
+
+S3 data events must be enabled in CloudTrail to capture the GetObject, PutObject, ListObjects, and DeleteObject actions. Ensure that the AWS CloudTrail service is configured to log data events for the S3 bucket you'd like to monitor.
+
 ==== Rule query
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-sns-rare-protocol-subscription-by-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-sns-rare-protocol-subscription-by-user.asciidoc
new file mode 100644
index 0000000000..3661709b8d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-sns-rare-protocol-subscription-by-user.asciidoc
@@ -0,0 +1,144 @@
+[[aws-sns-rare-protocol-subscription-by-user]]
+=== AWS SNS Rare Protocol Subscription by User
+
+Identifies when a use subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/sns/latest/api/API_Subscribe.html
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SNS
+* Resources: Investigation Guide
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Tactic: Collection
+* Tactic: Impact
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS SNS Rare Protocol Subscription by User*
+
+
+This rule identifies when an SNS topic is subscribed to by a rare protocol for a particular user. While subscribing to SNS topics is a common practice, adversaries may exploit this feature to collect sensitive information or exfiltrate data via an external email address, mobile number, or cross-account AWS service like Lambda.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed using a protocol for the first time.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` field to identify the user who requested the subscription. Verify if this actor typically performs such actions and has the necessary permissions. It may be unusual for this activity to originate from certain user types, such as an assumed role or federated user.
+- **Review the SNS Subscription Event**: Analyze the specifics of the `Subscribe` action in CloudTrail logs:
+  - **Topic**: Look at the `aws.cloudtrail.request_parameters` or `target.entity.id` field to identify the SNS topic involved in the subscription.
+  - **Protocol and Endpoint**: Review the `aws.cloudtrail.request_parameters` field to confirm the subscription's protocol and endpoint, if available. Confirm if this endpoint is associated with a known or trusted entity.
+  - **Subscription Status**: Check the `aws.cloudtrail.response_elements` field for the subscription's current status, noting if it requires confirmation.
+- **Verify Authorization**: Evaluate whether the user typically engages in SNS subscription actions and if they are authorized to do so for the specified topic.
+- **Contextualize with Related Events**: Review related CloudTrail logs around the event time for other actions by the same user or IP address. Look for activities involving other AWS services, such as S3 or IAM, that may indicate further suspicious behavior.
+- **Check for Publish Actions**: Investigate for any subsequent `Publish` actions on the same SNS topic that may indicate exfiltration attempts or data leakage. If Publish actions are detected, further investigate the contents of the messages.
+- **Review IAM Policies**: Examine the user or role's IAM policies to ensure that the subscription action is within the scope of their permissions or should be.
+
+
+*False Positive Analysis*
+
+
+- **Historical User Actions**: Verify if the user has a history of performing similar actions on SNS topics. Consistent, repetitive actions may suggest legitimate usage.
+- **Scheduled or Automated Tasks**: Confirm if the subscription action aligns with scheduled tasks or automated notifications authorized by your organization.
+
+
+*Response and Remediation*
+
+
+- **Immediate Review and Reversal**: If the subscription was unauthorized, take appropriate action to cancel it and adjust SNS permissions as necessary.
+- **Strengthen Monitoring and Alerts**: Configure monitoring systems to flag similar actions involving sensitive topics or unapproved endpoints.
+- **Policy Review**: Review and update policies related to SNS subscriptions and access, tightening control as needed to prevent unauthorized subscriptions.
+- **Incident Response**: If there is evidence of malicious intent, treat the event as a potential data exfiltration incident and follow incident response protocols, including further investigation, containment, and recovery.
+
+
+*Additional Information*
+
+
+For further guidance on managing and securing SNS topics in AWS environments, refer to the https://docs.aws.amazon.com/sns/latest/dg/welcome.html[AWS SNS documentation] and AWS best practices for security.
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset: "aws.cloudtrail"
+    and event.provider: "sns.amazonaws.com"
+    and event.action: "Subscribe"
+    and event.outcome: "success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Cloud Storage
+** ID: T1530
+** Reference URL: https://attack.mitre.org/techniques/T1530/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-created-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-created-by-rare-user.asciidoc
index 6badb5cf62..2a1b9bd4b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-created-by-rare-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-created-by-rare-user.asciidoc
@@ -1,7 +1,7 @@
 [[aws-sns-topic-created-by-rare-user]]
 === AWS SNS Topic Created by Rare User
 
-Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities.
+Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
 
 *Rule type*: new_terms
 
@@ -16,13 +16,15 @@ Identifies when an SNS topic is created by a user who does not typically perform
 
 *Runs every*: 5m
 
-*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
 *Maximum alerts per execution*: 100
 
 *References*: 
 
 * https://docs.aws.amazon.com/sns/latest/api/API_CreateTopic.html
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
 
 *Tags*: 
 
@@ -33,8 +35,9 @@ Identifies when an SNS topic is created by a user who does not typically perform
 * Resources: Investigation Guide
 * Use Case: Threat Detection
 * Tactic: Resource Development
+* Tactic: Impact
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -56,29 +59,29 @@ Identifies when an SNS topic is created by a user who does not typically perform
 
 This rule detects the creation of an AWS Simple Notification Service (SNS) topic by a user who does not typically perform this action. Adversaries may create SNS topics to facilitate data exfiltration or other malicious activities.
 
-This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time on a host in the last 10 days.
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time by a user or role.
 
 
 *Possible Investigation Steps*
 
 
 
-*1. Identify the Actor and Context*
+*Identify the Actor and Context*
 
 - **User Identity and Role**:
   - Examine `aws.cloudtrail.user_identity.arn` to determine **who** created the SNS topic.
-  - Identify whether the actor assumed a **privileged IAM role** (`aws.cloudtrail.user_identity.type: "AssumedRole"`).
+  - Identify whether the actor assumed a **privileged IAM role** (`aws.cloudtrail.user_identity.type: "AssumedRole"`) or used a long term access keys (`aws.cloudtrail.user_identity.access_key_id`).
 - **User Agent and Tooling**:
-  - Check `user_agent.name` to determine if this action was performed via the AWS CLI, SDK, or Console.
+  - Check `user_agent.original` to determine if this action was performed via the AWS CLI, SDK, or Console.
   - If `aws-cli` was used, review whether it aligns with typical automation or administrative behavior.
 - **Source IP and Geographic Location**:
   - Review `source.ip` and `source.geo` fields to confirm if the request originated from a **trusted** or **unexpected** location.
 
 
-*2. Evaluate the SNS Topic Creation*
+*Evaluate the SNS Topic Creation*
 
 - **Topic Name and Purpose**:
-  - Check `aws.cloudtrail.flattened.request_parameters.name` for the **SNS topic name** and determine whether it appears suspicious (e.g., random strings, unusual keywords).
+  - Check `aws.cloudtrail.request_parameters` for the **SNS topic name** and determine whether it appears suspicious (e.g., random strings, unusual keywords).
 - **Target Region and Account**:
   - Verify `cloud.region` and `cloud.account.id` to **ensure the SNS topic was created in an expected environment**.
 - **Associated API Calls**:
@@ -89,7 +92,7 @@ This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#
   - These may indicate follow-up steps taken to misuse the SNS topic.
 
 
-*3. Analyze Potential Malicious Intent*
+*Analyze Potential Malicious Intent*
 
 - **Is This an Isolated Action or a Pattern?**
   - Check if this **user has previously created SNS topics** using historical CloudTrail logs.
@@ -135,8 +138,6 @@ event.dataset: "aws.cloudtrail"
     and event.provider: "sns.amazonaws.com"
     and event.action: "CreateTopic"
     and event.outcome: "success"
-    and aws.cloudtrail.user_identity.type: "AssumedRole"
-    and aws.cloudtrail.user_identity.arn: *i-*
 
 ----------------------------------
 
@@ -150,3 +151,15 @@ event.dataset: "aws.cloudtrail"
 ** Name: Stage Capabilities
 ** ID: T1608
 ** Reference URL: https://attack.mitre.org/techniques/T1608/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-message-publish-by-rare-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-message-publish-by-rare-user.asciidoc
new file mode 100644
index 0000000000..4b37c40980
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-sns-topic-message-publish-by-rare-user.asciidoc
@@ -0,0 +1,177 @@
+[[aws-sns-topic-message-publish-by-rare-user]]
+=== AWS SNS Topic Message Publish by Rare User
+
+Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/sns/latest/api/API_Publish.html
+* https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploting_public_resources_attack_playbook/
+* https://permiso.io/blog/s/smishing-attack-on-aws-sms-new-phone-who-dis/
+* https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SNS
+* Use Case: Threat Detection
+* Resources: Investigation Guide
+* Tactic: Lateral Movement
+* Tactic: Exfiltration
+* Tactic: Impact
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and Analysis*
+
+
+
+*Investigating AWS SNS Topic Message Publish by Rare User*
+
+
+This rule identifies when a message is published to an SNS topic by a user who has rarely or never published messages before. This activity could indicate adversarial actions, such as using SNS topics for phishing campaigns, data exfiltration, or lateral movement within an AWS environment.
+
+This is a https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-new-terms-rule[New Terms] rule that only flags when this behavior is observed for the first time by a user or role.
+
+
+*Possible Investigation Steps*
+
+
+- **Identify the Actor and Resource**:
+  - **User Identity and Role**: Examine the `aws.cloudtrail.user_identity.arn` to identify the user or role responsible for publishing the SNS message. Verify whether this actor is authorized to publish messages to SNS topics.
+  - **Access Key Details**: Review the `aws.cloudtrail.user_identity.access_key_id` to determine the access key used.
+  - **SNS Topic ARN**: Analyze `aws.cloudtrail.resources.arn` to confirm whether the SNS topic is critical, sensitive, or used for authorized purposes.
+
+- **Evaluate the Context of the SNS Message**:
+  - **Published Message Details**: AWS redacts the message content in CloudTrail logs, but you can view the message ID, subject, and other metadata. Investigate the message details for any indicators of malicious content.
+  - **Message Recipients**: Investigate the subscriptions associated with the SNS topic to identify if messages were sent to unauthorized or unexpected recipients.
+
+- **Analyze Source Information**:
+  - **Source IP Address**: Examine the `source.ip` field to identify the origin of the activity. Unusual IP addresses or geolocations may indicate unauthorized access.
+  - **User Agent**: Review `user_agent.original` to determine the tool or client used for publishing the SNS message. Automated tools or unexpected clients (e.g., `Boto3` from an unknown host) may signify misuse.
+
+- **Review Historical Activity**:
+  - **Actor’s Past Behavior**: Identify whether the user has published messages to SNS topics before. Review similar past events for context.
+  - **Frequency and Patterns**: Examine the time and frequency of messages published by the same user or to the same SNS topic to detect anomalies.
+
+- **Correlate with Other Events**:
+  - **IAM or CloudTrail Events**: Look for events such as `AssumeRole`, `CreateAccessKey`, or other API actions associated with the same user ARN.
+  - **Unusual IAM Role Activity**: Determine if the actor has assumed roles or performed administrative tasks atypical for their role.
+
+
+*False Positive Analysis*
+
+
+- **Routine Operational Use**:
+  - Confirm if the publishing activity aligns with standard operational tasks or automation scripts.
+  - Validate whether new or rare users were recently granted permissions for publishing messages to SNS topics.
+
+- **Testing or Monitoring Scripts**:
+  - Automated testing or monitoring tools may trigger this rule if configured to publish messages to SNS topics.
+
+
+*Response and Remediation*
+
+
+- **Immediate Action**:
+  - If unauthorized activity is confirmed, disable the access key or IAM role associated with the user.
+  - Restrict or remove permissions from the SNS topic to prevent further misuse.
+
+- **Review Policies and Subscriptions**:
+  - Audit the IAM policies tied to the user and SNS topic to ensure appropriate permissions.
+  - Validate the subscriptions of the SNS topic to confirm all endpoints are authorized.
+
+- **Enhance Monitoring and Alerting**:
+  - Set up additional logging or alerting for SNS publish actions, especially from rare or unknown users.
+  - Monitor for similar actions across other SNS topics within the environment.
+
+- **Conduct a Root Cause Analysis**:
+  - Investigate how the user or role gained access to publish messages to the SNS topic.
+  - Determine if other AWS resources or services have been affected.
+
+
+*Additional Information*
+
+
+For more information on SNS topic management and securing AWS resources, refer to:
+- https://docs.aws.amazon.com/sns/latest/api/API_Publish.html[AWS SNS Publish API Documentation]
+- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference.html[AWS CloudTrail Documentation]
+
+
+==== Setup
+
+
+AWS SNS topic data event types need to be enabled in the CloudTrail trail configuration to capture the Publish action. Ensure that the AWS CloudTrail service is https://docs.aws.amazon.com/sns/latest/dg/logging-using-cloudtrail.html#cloudtrail-data-events[configured] to log data events for SNS.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:"aws.cloudtrail"
+    and event.provider:"sns.amazonaws.com"
+    and event.action:"Publish"
+    and event.outcome:"success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Internal Spearphishing
+** ID: T1534
+** Reference URL: https://attack.mitre.org/techniques/T1534/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Resource Hijacking
+** ID: T1496
+** Reference URL: https://attack.mitre.org/techniques/T1496/
+* Sub-technique:
+** Name: Cloud Service Hijacking
+** ID: T1496.004
+** Reference URL: https://attack.mitre.org/techniques/T1496/004/
diff --git a/docs/detections/prebuilt-rules/rule-details/aws-ssm-session-started-to-ec2-instance.asciidoc b/docs/detections/prebuilt-rules/rule-details/aws-ssm-session-started-to-ec2-instance.asciidoc
new file mode 100644
index 0000000000..8a4233accd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/aws-ssm-session-started-to-ec2-instance.asciidoc
@@ -0,0 +1,125 @@
+[[aws-ssm-session-started-to-ec2-instance]]
+=== AWS SSM Session Started to EC2 Instance
+
+Identifies the first occurrence of an AWS user or role establishing a session via SSM to an EC2 instance. Adversaries may use AWS Session Manager to establish a session to an EC2 instance to execute commands on the instance. This can be used to gain access to the instance and perform actions such as privilege escalation.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-aws.cloudtrail-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-6m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html
+* https://hackingthe.cloud/aws/post_exploitation/intercept_ssm_communications/
+* https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc
+* https://unit42.paloaltonetworks.com/cloud-lateral-movement-techniques
+
+*Tags*: 
+
+* Domain: Cloud
+* Data Source: AWS
+* Data Source: Amazon Web Services
+* Data Source: AWS SSM
+* Data Source: AWS EC2
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AWS SSM Session Started to EC2 Instance*
+
+
+This rule detects the first instance of an AWS user or role initiating an SSM session to an EC2 instance, which could be indicative of legitimate administrative activities or potential malicious actions like command execution or lateral movement.
+
+
+*Possible Investigation Steps*
+
+
+- **Examine the Session Start Event**: Review the AWS CloudTrail log for the event.
+    - Determine the target EC2 instance using `aws.cloudtrail.request_parameters`.
+- **Verify User Identity and Role**: Check the user’s ARN and access key ID (`aws.cloudtrail.user_identity.access_key_id`).
+    - Determine if their role typically requires initiating SSM sessions.
+- **Assess Geographic and IP Context**: Analyze the source IP (`source.ip`) and geographic location (`source.geo`) from which the session was initiated.
+    - Determine if these are consistent with typical user locations or if they raise suspicions of compromise or misuse.
+- **Review Session Details**: Examine details like the session ID and stream URL (`aws.cloudtrail.response_elements`) to understand the scope and nature of the session.
+    - Check if any commands executed during the session were unauthorized or out of ordinary practices.
+- **Correlate with Other Security Events**: Look for other related security events around the time of the session start to identify any pattern or broader attack vector that may involve this user or EC2 instance.
+
+
+*False Positive Analysis*
+
+
+- **Legitimate Administrative Activities**: Confirm whether the SSM session was initiated for valid administrative purposes such as system maintenance, patching, or configuration updates. Verify with the respective teams or personnel.
+
+
+*Response and Remediation*
+
+
+- **Incident Response Activation**: If malicious intent or actions are confirmed, activate the incident response protocol.
+    - This includes containment of the threat, eradication of the adversary’s presence, recovery of affected systems, and a thorough investigation.
+- **Validate and Reinforce Security Policies**: Ensure that policies around SSM session initiation are strict and adhere to the principle of least privilege.
+    - Update IAM policies if necessary to tighten controls.
+- **Enhance Monitoring and Alerts**: Improve monitoring of SSM sessions, particularly focusing on sessions that involve sensitive or critical EC2 instances.
+    - Adjust alerting mechanisms to flag unusual session initiations promptly.
+
+
+*Additional Information*
+
+
+For more in-depth understanding of managing SSM sessions and security best practices, refer to the https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartSession.html[AWS Systems Manager documentation]. Additionally, consider the security implications and best practices outlined in https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc[AWS SSM privilege escalation techniques].
+
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.dataset:"aws.cloudtrail" and event.provider:"ssm.amazonaws.com"
+    and event.action:"StartSession" and event.outcome:"success"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Cloud Services
+** ID: T1021.007
+** Reference URL: https://attack.mitre.org/techniques/T1021/007/
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index 72bdd10e6e..71426e605d 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -45,7 +45,7 @@ Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 320
+*Version*: 321
 
 *Rule authors*: 
 
@@ -136,8 +136,8 @@ process where host.os.type == "windows" and event.type == "start" and
         "?:\\Windows\\System32\\WerFault.exe",
 
         /* Crowdstrike specific exclusion as it uses NT Object paths */
-        "?\\Device\\HarddiskVolume*\\Windows\\Sys?????\\mmc.exe",
-        "?\\Device\\HarddiskVolume*\\Windows\\Sys?????\\WerFault.exe"
+        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\mmc.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\Sys?????\\WerFault.exe"
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
index 53b08a775a..65f15be149 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
@@ -49,7 +49,7 @@ Identifies when a user attempts to clear console history. An adversary may clear
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -111,7 +111,7 @@ Attackers can try to cover their tracks by clearing PowerShell console history.
 process where host.os.type == "windows" and event.type == "start" and
   (
     process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-    ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
   ) and
   (
     process.args : "*Clear-History*" or
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
index bf7de6d006..74911de048 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
@@ -46,7 +46,7 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 318
+*Version*: 319
 
 *Rule authors*: 
 
@@ -115,7 +115,7 @@ process where host.os.type == "windows" and event.type == "start" and
   (
     (
       process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-      ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
+      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
     ) and
     process.args : "Clear-EventLog"
   )
diff --git a/docs/detections/prebuilt-rules/rule-details/command-and-scripting-interpreter-via-windows-scripts.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-and-scripting-interpreter-via-windows-scripts.asciidoc
index ca35e09818..cd4b5adc2c 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-and-scripting-interpreter-via-windows-scripts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-and-scripting-interpreter-via-windows-scripts.asciidoc
@@ -42,7 +42,7 @@ Identifies PowerShell.exe or Cmd.exe execution spawning from Windows Script Host
 * Data Source: Elastic Endgame
 * Data Source: Crowdstrike
 
-*Version*: 206
+*Version*: 207
 
 *Rule authors*: 
 
@@ -105,7 +105,11 @@ PowerShell, a powerful scripting language in Windows, is often targeted by adver
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
-  process.name : ("powershell.exe", "pwsh.exe", "cmd.exe") and
+  process.command_line != null and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe", "cmd.exe") or
+    ?process.pe.original_file_name : ("powershell.exe", "pwsh.dll", "powershell_ise.exe", "Cmd.Exe")
+  ) and
   process.parent.name : ("wscript.exe", "mshta.exe")
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
index efd6bd7c40..09712c0fec 100644
--- a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
@@ -9,9 +9,9 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 
 * logs-endpoint.events.registry-*
 
-*Severity*: medium
+*Severity*: low
 
-*Risk score*: 47
+*Risk score*: 21
 
 *Runs every*: 5m
 
@@ -32,10 +32,9 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 * Tactic: Defense Evasion
 * Tactic: Privilege Escalation
 * Resources: Investigation Guide
-* Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 116
+*Version*: 117
 
 *Rule authors*: 
 
@@ -99,20 +98,6 @@ Adversaries can insert malicious code that can be executed in place of legitimat
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-==== Setup
-
-
-
-*Setup*
-
-
-If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
-events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
-Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
-`event.ingested` to @timestamp.
-For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
-
-
 ==== Rule query
 
 
@@ -141,34 +126,52 @@ registry where host.os.type == "windows" and event.type == "change" and
         "HKEY_USERS\\*\\DelegateExecute",
         "HKEY_USERS\\*\\TreatAs\\",
         "HKEY_USERS\\*\\ScriptletURL*"
-      )  
+      ) and
+      not registry.data.strings : (
+            /* COM related to Windows Spotlight feature */
+            "{4813071a-41ad-44a2-9835-886d2f63ca30}",
+
+            /* AppX/MSIX DelegateExecute handlers: execute, protocol, file */
+            "{A56A841F-E974-45C1-8001-7E3F8A085917}",
+            "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
+            "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}"
+      )
+    )
+  ) and 
+  
+  not (
+    process.code_signature.trusted == true and
+    process.code_signature.subject_name in (
+        "Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.", "Adobe Inc.",
+        "Citrix Systems, Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.", "Oracle America, Inc.",
+        "Brave Software, Inc.", "DeepL SE", "Opera Norway AS"
     )
   ) and 
-
-      not  (
-            process.code_signature.trusted == true and
-            process.code_signature.subject_name in 
-                         ("Island Technology Inc.", "Google LLC", "Grammarly, Inc.", "Dropbox, Inc", "REFINITIV US LLC", "HP Inc.",
-                          "Citrix Systems, Inc.", "Adobe Inc.", "Veeam Software Group GmbH", "Zhuhai Kingsoft Office Software Co., Ltd.",
-                          "Oracle America, Inc.")
-        ) and 
 
   /* excludes Microsoft signed noisy processes */
   not
   (
-    process.name : ("OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe", "MicrosoftEdgeUpdateComRegisterShell64.exe") and
+    process.name : (
+      "OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe", "MicrosoftEdgeUpdate.exe", "msrdcw.exe",
+      "MicrosoftEdgeUpdateComRegisterShell64.exe", "setup.exe"
+    ) and
     process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
   ) and
   
-  not process.executable : 
-                  ("?:\\Program Files (x86)\\*.exe", 
-                   "?:\\Program Files\\*.exe",
-                   "?:\\Windows\\System32\\svchost.exe", 
-                   "?:\\Windows\\System32\\msiexec.exe", 
-                   "?:\\Windows\\SysWOW64\\regsvr32.exe",
-                   "?:\\Windows\\System32\\regsvr32.exe",
-                   "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe", 
-                   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe")
+  not process.executable : (
+        "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Program Files\\*.exe",
+        "?:\\ProgramData\\4Team\\4Team-Updater\\4Team-Updater-Helper.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+        "?:\\Users\\*\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe",
+        "?:\\Windows\\System32\\DriverStore\\FileRepository\\*.exe",
+        "?:\\Windows\\System32\\msiexec.exe",
+        "?:\\Windows\\System32\\svchost.exe",
+        "?:\\Windows\\SysWOW64\\regsvr32.exe",
+        "?:\\Windows\\System32\\regsvr32.exe",
+        "\\Device\\Mup\\*\\Kufer\\KuferSQL\\BasysSQL.exe"
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-common-large-language-model-endpoints.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-common-large-language-model-endpoints.asciidoc
index 49c0249a8e..48bd9ab911 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-common-large-language-model-endpoints.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-common-large-language-model-endpoints.asciidoc
@@ -39,7 +39,7 @@ Identifies DNS queries to known Large Language Model domains by unsigned binarie
 * Data Source: SentinelOne
 * Data Source: Sysmon
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -104,7 +104,10 @@ network where host.os.type == "windows" and dns.question.name != null and
 
   ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
 
-  (process.executable : ("?:\\Users\\*.exe", "", "?:\\ProgramData\\*.exe") and ?process.code_signature.trusted != true)
+  (
+    process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe") and
+    (?process.code_signature.trusted == false or ?process.code_signature.exists == false)
+  )
  ) and
     dns.question.name : (
     // Major LLM APIs
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 2a7ec31d1a..44939fe014 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -8,6 +8,7 @@ Adversaries may implement command and control (C2) communications that use commo
 *Rule indices*: 
 
 * logs-endpoint.events.network-*
+* logs-sentinel_one_cloud_funnel.*
 
 *Severity*: low
 
@@ -32,8 +33,9 @@ Adversaries may implement command and control (C2) communications that use commo
 * Tactic: Command and Control
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
+* Data Source: SentinelOne
 
-*Version*: 121
+*Version*: 122
 
 *Rule authors*: 
 
@@ -114,8 +116,9 @@ This rule looks for processes outside known legitimate program locations communi
 
 [source, js]
 ----------------------------------
-network where host.os.type == "windows" and network.protocol == "dns" and
-    process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+network where host.os.type == "windows" and
+    dns.question.name != null and process.name != null and
+    not (?user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") or user.domain == "NT AUTHORITY") and
     /* Add new WebSvc domains here */
     dns.question.name :
        (
@@ -208,23 +211,23 @@ network where host.os.type == "windows" and network.protocol == "dns" and
         process.executable : (
           "?:\\Program Files\\*.exe",
           "?:\\Program Files (x86)\\*.exe",
-          "?:\\Windows\\system32\\svchost.exe",
-          "?:\\Windows\\System32\\WWAHost.exe",
-          "?:\\Windows\\System32\\smartscreen.exe",
-          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
-          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
           "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
-          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
-          "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
-          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
           "?:\\Users\\*\\AppData\\Local\\PowerToys\\PowerToys.exe",
+          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Zen Browser\\zen.exe",
+          "?:\\Users\\*\\Wavesor Software\\WaveBrowser\\wavebrowser.exe",
+          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
           "?:\\Windows\\system32\\mobsync.exe",
           "?:\\Windows\\SysWOW64\\mobsync.exe", 
+          "?:\\Windows\\system32\\svchost.exe",
+          "?:\\Windows\\System32\\smartscreen.exe",
           "?:\\Windows\\System32\\wsl.exe", 
-          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe"
+          "?:\\Windows\\System32\\WWAHost.exe"
         )
       ) or
     
@@ -233,19 +236,9 @@ network where host.os.type == "windows" and network.protocol == "dns" and
        process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
       ) or 
 
-      /* MS Sharepoint */
-      (process.name : "Microsoft.SharePoint.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
-       process.code_signature.trusted == true) and dns.question.name : "onedrive.live.com"
-      ) or 
-
-      /* Firefox */
-      (process.name : "firefox.exe" and (process.code_signature.subject_name : "Mozilla Corporation" and
-       process.code_signature.trusted == true)
-      ) or 
-
-      /* Dropbox */
-      (process.name : "Dropbox.exe" and (process.code_signature.subject_name : "Dropbox, Inc" and
-       process.code_signature.trusted == true) and dns.question.name : ("api.dropboxapi.com", "*.dropboxusercontent.com")
+      /* MS Sharepoint / OneDrive */
+      (process.name : ("Microsoft.SharePoint.exe", "OneDrive.Sync.Service.exe") and dns.question.name : "onedrive.live.com" and
+       (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
       ) or 
 
       /* Obsidian - Plugins are stored on raw.githubusercontent.com */
@@ -258,16 +251,37 @@ network where host.os.type == "windows" and network.protocol == "dns" and
        process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com")
       ) or
 
-      /* IntelliJ IDEA connecting to raw.githubusercontent.com m */
+      /* IntelliJ IDEA connecting to raw.githubusercontent.com */
       (process.code_signature.subject_name : "JetBrains s.r.o." and
-       process.code_signature.trusted == true and dns.question.name : "raw.githubusercontent.com")  or 
+       process.code_signature.trusted == true and dns.question.name : ("api.github.com", "raw.githubusercontent.com")
+      ) or 
 
       (process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true and
-       dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com", "login.live.com")) or
+       dns.question.name : ("*.sharepoint.com", "graph.microsoft.com", "g.live.com", "login.live.com")
+      ) or
+
+      (process.code_signature.subject_name : "Python Software Foundation" and process.code_signature.trusted == true and
+       dns.question.name : "files.pythonhosted.org") or 
+
+      /* Zoom */
+      (process.name : "Zoom.exe" and (process.code_signature.subject_name : "Zoom Video Communications, Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("www.googleapis.com", "graph.microsoft.com")
+      ) or
 
-      (process.code_signature.trusted == true and
-       process.code_signature.subject_name :
-                             ("Johannes Schindelin",
+      /* VSCode */
+      (process.name : "Code.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
+       process.code_signature.trusted == true) and dns.question.name : ("api.github.com", "raw.githubusercontent.com")
+      ) or
+
+      /* Terraform */
+      (process.name : "terraform-provider*.exe" and (process.code_signature.subject_name : "HashiCorp, Inc." and
+       process.code_signature.trusted == true) and dns.question.name : "graph.microsoft.com"
+      ) or
+
+      (
+        process.code_signature.trusted == true and
+        process.code_signature.subject_name : (
+                              "Johannes Schindelin",
                               "Redis Inc.",
                               "Slack Technologies, LLC",
                               "Cisco Systems, Inc.",
@@ -275,7 +289,10 @@ network where host.os.type == "windows" and network.protocol == "dns" and
                               "Amazon.com Services LLC", 
                               "Island Technology Inc.", 
                               "GitHub, Inc.", 
-                              "Red Hat, Inc"))
+                              "Red Hat, Inc",
+                              "Mozilla Corporation"
+        )
+      )
     )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/crowdstrike-external-alerts.asciidoc b/docs/detections/prebuilt-rules/rule-details/crowdstrike-external-alerts.asciidoc
index 0264e9bad4..3ea8793efb 100644
--- a/docs/detections/prebuilt-rules/rule-details/crowdstrike-external-alerts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/crowdstrike-external-alerts.asciidoc
@@ -25,12 +25,12 @@ Generates a detection alert for each CrowdStrike alert written to the configured
 
 *Tags*: 
 
-* Data Source: CrowdStrike
+* Data Source: Crowdstrike
 * Use Case: Threat Detection
 * Resources: Investigation Guide
 * Promotion: External Alerts
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/d-bus-service-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/d-bus-service-created.asciidoc
index ec66e0d38d..e53e895db9 100644
--- a/docs/detections/prebuilt-rules/rule-details/d-bus-service-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/d-bus-service-created.asciidoc
@@ -35,7 +35,7 @@ This rule detects the creation of D-Bus service files on Linux systems. D-Bus is
 * Data Source: Elastic Endgame
 * Resources: Investigation Guide
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -156,7 +156,6 @@ file.extension in ("service", "conf") and file.path like~ (
     "/usr/sbin/sshd", "/usr/bin/gitlab-runner", "/opt/gitlab/embedded/bin/ruby", "/usr/sbin/gdm", "/usr/bin/install",
     "/usr/local/manageengine/uems_agent/bin/dcregister"
   ) or
-  file.Ext.original.extension == "dpkg-new" or
   process.executable : (
     "/nix/store/*", "/var/lib/dpkg/*", "/tmp/vmis.*", "/snap/*", "/dev/fd/*", "/usr/lib/virtualbox/*"
   ) or
diff --git a/docs/detections/prebuilt-rules/rule-details/deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc b/docs/detections/prebuilt-rules/rule-details/deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
new file mode 100644
index 0000000000..58a96556b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/deprecated-execution-of-file-written-or-modified-by-pdf-reader.asciidoc
@@ -0,0 +1,152 @@
+[[deprecated-execution-of-file-written-or-modified-by-pdf-reader]]
+=== Deprecated - Execution of File Written or Modified by PDF Reader
+
+Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 60m
+
+*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Deprecated - Execution of File Written or Modified by PDF Reader*
+
+
+PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
+
+This rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as PDF readers.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve the PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=2h
+  [file where host.os.type == "windows" and event.type != "deletion" and file.extension : "exe" and
+     (process.name : "AcroRd32.exe" or
+      process.name : "rdrcef.exe" or
+      process.name : "FoxitPhantomPDF.exe" or
+      process.name : "FoxitReader.exe") and
+     not (file.name : "FoxitPhantomPDF.exe" or
+          file.name : "FoxitPhantomPDFUpdater.exe" or
+          file.name : "FoxitReader.exe" or
+          file.name : "FoxitReaderUpdater.exe" or
+          file.name : "AcroRd32.exe" or
+          file.name : "rdrcef.exe")
+  ] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start"] by host.id, process.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
index 7cf0bf724a..f8eb9a0b7b 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -47,7 +47,7 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 317
+*Version*: 318
 
 *Rule authors*: 
 
@@ -117,7 +117,7 @@ process where host.os.type == "windows" and event.type == "start" and
   (
     (
       process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or
-      ?process.pe.original_file_name in ("pwsh.exe", "powershell.exe", "powershell_ise.exe")
+      ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
     ) and
 	  process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled"
   )  or
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
index b65748ef89..e3ed6c4a84 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -49,7 +49,7 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -119,7 +119,7 @@ This rule monitors the execution of commands that can tamper the Windows Defende
 process where host.os.type == "windows" and event.type == "start" and
   (
     process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-    ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
   ) and
   process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
 
diff --git a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
index 85dcef3bf4..f583ae2650 100644
--- a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
@@ -42,7 +42,7 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 * Data Source: Microsoft Defender for Endpoint
 * Data Source: SentinelOne
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -97,20 +97,6 @@ These steps are usually done in preparation for exfiltration, meaning the attack
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-==== Setup
-
-
-
-*Setup*
-
-
-If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
-events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
-Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
-`event.ingested` to @timestamp.
-For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
-
-
 ==== Rule query
 
 
@@ -120,8 +106,8 @@ process where host.os.type == "windows" and event.type == "start" and
 (
   (
     (
-      process.name:"rar.exe" or ?process.code_signature.subject_name == "win.rar GmbH" or
-      ?process.pe.original_file_name == "Command line RAR"
+      process.name : ("rar.exe", "WinRAR.exe") or ?process.code_signature.subject_name == "win.rar GmbH" or
+      ?process.pe.original_file_name == "WinRAR.exe"
     ) and
     process.args == "a" and process.args : ("-hp*", "-p*", "/hp*", "/p*")
   ) or
diff --git a/docs/detections/prebuilt-rules/rule-details/entra-id-mfa-disabled-for-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/entra-id-mfa-disabled-for-user.asciidoc
index 27e3c107ea..5cc8f1af92 100644
--- a/docs/detections/prebuilt-rules/rule-details/entra-id-mfa-disabled-for-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/entra-id-mfa-disabled-for-user.asciidoc
@@ -7,7 +7,6 @@ Identifies when multi-factor authentication (MFA) is disabled for an Entra ID us
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.auditlogs-*
 
 *Severity*: medium
@@ -33,7 +32,7 @@ Identifies when multi-factor authentication (MFA) is disabled for an Entra ID us
 * Resources: Investigation Guide
 * Tactic: Persistence
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-sign-in-risk.asciidoc b/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-sign-in-risk.asciidoc
index f2d9d1698f..28cadb258e 100644
--- a/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-sign-in-risk.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-sign-in-risk.asciidoc
@@ -7,7 +7,6 @@ Identifies sign-in risk detection events via Microsofts Entra ID Protection serv
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.identity_protection-*
 
 *Severity*: high
@@ -40,7 +39,7 @@ Identifies sign-in risk detection events via Microsofts Entra ID Protection serv
 * Tactic: Initial Access
 * Resources: Investigation Guide
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-user-risk.asciidoc b/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-user-risk.asciidoc
index 024cb24955..165d17c7e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-user-risk.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/entra-id-protection-risk-detection-user-risk.asciidoc
@@ -7,7 +7,6 @@ Identifies user risk detection events via Microsofts Entra ID Protection service
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.identity_protection-*
 
 *Severity*: high
@@ -37,7 +36,7 @@ Identifies user risk detection events via Microsofts Entra ID Protection service
 * Tactic: Initial Access
 * Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
index 25b956a47a..7b1c186bd3 100644
--- a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
@@ -35,7 +35,7 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 212
+*Version*: 213
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
index 2c68561a2e..3d3acf5cf5 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -3,7 +3,7 @@
 
 Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
 *Rule indices*: 
 
@@ -17,9 +17,9 @@ Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may
 * logs-windows.sysmon_operational-*
 * winlogbeat-*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -46,7 +46,7 @@ Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -107,18 +107,29 @@ The xp_cmdshell procedure is disabled by default, but when used, it has the same
 
 [source, js]
 ----------------------------------
-process where host.os.type == "windows" and event.type == "start" and process.parent.name : "sqlservr.exe" and 
+host.os.type:windows and event.category:process and event.type:start and
+process.parent.name:"sqlservr.exe" and process.command_line : * and
+(
   (
-   (process.name : "cmd.exe" and 
-    not process.args : ("\\\\*", "diskfree", "rmdir", "mkdir", "dir", "del", "rename", "bcp", "*XMLNAMESPACES*", 
-                        "?:\\MSSQL\\Backup\\Jobs\\sql_agent_backup_job.ps1", "K:\\MSSQL\\Backup\\msdb", "K:\\MSSQL\\Backup\\Logins")) or 
-                        
-   (process.name : "vpnbridge.exe" or ?process.pe.original_file_name : "vpnbridge.exe") or 
-
-   (process.name : "certutil.exe" or ?process.pe.original_file_name == "CertUtil.exe") or 
-
-   (process.name : "bitsadmin.exe" or ?process.pe.original_file_name == "bitsadmin.exe")
-  )
+    (process.name.caseless : "cmd.exe" or process.pe.original_file_name : "Cmd.Exe") and
+    not process.args : (
+          \\\\* or diskfree or rmdir or mkdir or dir or DIR or del or rename or bcp or md or ren or REN or send or echo or
+          ECHO or TYPE or type or EXIST or forfiles or sqlcmd or SQLCMD or dtexec or Sort-Object or cat or copy or COPY or
+          move or MOVE or CD\\ or show or rd or powercfg or "C:\SPAN4\DATA\RISKPARAM.SPN" or ("@ECHO" and "@FOR") or
+          ("@echo" and "@for") or (SET and PATH=*) or ("-ExecutionPolicy" and "-File") or MSSQLFDLauncher$DATEV_DBENGINE or
+          (wmic and (cpu or computersystem or logicaldisk or os or ComputerSystem or volume)) or -s\:C\:\\WINDOWS\\SERVIC* or
+          D\:\\* or E\:\\* or F\:\\* or Z\:\\* or "C:\Program Files\Amazon\AWSCLIV2\aws.exe" or C\:\\7-Zip\\7z.exe* or
+          C\:\\FTP* or *\(Get-Item* or C\:\\ProgramData\\Daktronics*
+    ) and
+    not process.command_line : (
+          "\"C:\\Windows\\system32\\cmd.exe\" /c " or
+          "\"C:\\Windows\\System32\\cmd.exe\""
+    )
+  ) or
+  process.name.caseless:("bitsadmin.exe" or "certutil.exe" or "vpnbridge.exe") or
+  process.name:("bitsadmin.exe" or "certutil.exe" or "vpnbridge.exe") or
+  process.pe.original_file_name:("CertUtil.exe" or "bitsadmin.exe" or "vpnbridge.exe")
+)
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-egress-network-connections-from-unusual-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-egress-network-connections-from-unusual-executable.asciidoc
index 5dd38e5981..28fc6dba04 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-egress-network-connections-from-unusual-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-egress-network-connections-from-unusual-executable.asciidoc
@@ -28,7 +28,7 @@ This rule detects a high number of egress network connections from an unusual ex
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -139,8 +139,17 @@ from logs-endpoint.events.network-*
         process.executable like "/tmp/*" or
         process.executable like "/var/tmp/*" or
         process.executable like "/dev/shm/*" or
-        process.name rlike ".*"
-    ) and not (
+        process.executable like "/var/log/*" or
+        process.executable like "/sys/*" or
+        process.executable like "/media/*" or
+        process.executable like "/proc/*" or
+        process.executable like "/var/backups/*" or
+        process.executable like "/var/mail/*" or
+        process.executable like "/var/spool/*" or
+        process.executable like "./*" or
+        process.name like ".*"
+    ) and
+    not (
         cidr_match(destination.ip,
             "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
             "192.0.0.0/24", "192.0.0.29/32", "192.0.0.8/32", "192.0.0.9/32",
@@ -149,7 +158,6 @@ from logs-endpoint.events.network-*
             "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
             "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
         ) or
-        process.executable like "/nix/store/*" or
         process.executable like "/tmp/newroot/*" or
         process.executable like "/tmp/.mount*" or
         process.executable like "/tmp/go-build*"
diff --git a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
index 97c9d54bad..3d3f739a1d 100644
--- a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
@@ -25,7 +25,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 
 *Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
 
-*Maximum alerts per execution*: 33
+*Maximum alerts per execution*: 100
 
 *References*: None
 
@@ -44,7 +44,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 315
+*Version*: 316
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index 8cced26b3b..86359a3628 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -3,7 +3,7 @@
 
 Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
 *Rule indices*: 
 
@@ -11,9 +11,9 @@ Identifies handle requests for the Local Security Authority Subsystem Service (L
 * logs-windows.forwarded*
 * winlogbeat-*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -39,7 +39,7 @@ Identifies handle requests for the Local Security Authority Subsystem Service (L
 * Resources: Investigation Guide
 * Data Source: Windows Security Event Logs
 
-*Version*: 215
+*Version*: 216
 
 *Rule authors*: 
 
@@ -136,7 +136,7 @@ Audit File System (Success,Failure)
 Audit Handle Manipulation (Success,Failure)
 ```
 
-Also, this event generates only if the object’s https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists[SACL] has the required access control entry (ACE) to handle the use of specific access rights.
+Also, this event generates only if the object's https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists[SACL] has the required access control entry (ACE) to handle the use of specific access rights.
 
 
 ==== Rule query
@@ -144,30 +144,20 @@ Also, this event generates only if the object’s https://docs.microsoft.com/en-
 
 [source, js]
 ----------------------------------
-any where event.code == "4656" and
-
-    winlog.event_data.ObjectName : (
-        "?:\\Windows\\System32\\lsass.exe",
-        "\\Device\\HarddiskVolume?\\Windows\\System32\\lsass.exe",
-        "\\Device\\HarddiskVolume??\\Windows\\System32\\lsass.exe") and
-
-    /* The right to perform an operation controlled by an extended access right. */
-
-    (winlog.event_data.AccessMask : ("0x1fffff" , "0x1010", "0x120089", "0x1F3FFF") or
-     winlog.event_data.AccessMaskDescription : ("READ_CONTROL", "Read from process memory"))
-
-     /* Common Noisy False Positives */
-
-    and not winlog.event_data.ProcessName : (
-        "?:\\Program Files\\*.exe",
-        "?:\\Program Files (x86)\\*.exe",
-        "?:\\Windows\\system32\\wbem\\WmiPrvSE.exe",
-        "?:\\Windows\\System32\\dllhost.exe",
-        "?:\\Windows\\System32\\svchost.exe",
-        "?:\\Windows\\System32\\msiexec.exe",
-        "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
-        "?:\\Windows\\explorer.exe",
-        "?:\\Windows\\System32\\poqexec.exe")
+host.os.type:"windows" and event.code:"4656" and
+  (
+    winlog.event_data.AccessMask : ("0x1fffff" or "0x1010" or "0x120089" or "0x1F3FFF") or
+    winlog.event_data.AccessMaskDescription : ("READ_CONTROL" or "Read from process memory")
+  ) and
+  winlog.event_data.ObjectName : *\\Windows\\System32\\lsass.exe and
+  not winlog.event_data.ProcessName : (
+      "C:\Windows\System32\wbem\WmiPrvSE.exe" or
+      "C:\Windows\SysWOW64\wbem\WmiPrvSE.exe" or
+      "C:\Windows\System32\dllhost.exe" or
+      "C:\Windows\System32\svchost.exe" or
+      "C:\Windows\System32\msiexec.exe" or
+      "C:\Windows\explorer.exe"
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/m365-portal-login-atypical-travel.asciidoc b/docs/detections/prebuilt-rules/rule-details/m365-portal-login-atypical-travel.asciidoc
index 5f39e18512..3e59936f2b 100644
--- a/docs/detections/prebuilt-rules/rule-details/m365-portal-login-atypical-travel.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/m365-portal-login-atypical-travel.asciidoc
@@ -7,7 +7,6 @@ Detects successful Microsoft 365 portal logins from rare locations. Rare locatio
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-o365.audit-*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Detects successful Microsoft 365 portal logins from rare locations. Rare locatio
 * Tactic: Initial Access
 * Resources: Investigation Guide
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/m365-portal-login-impossible-travel.asciidoc b/docs/detections/prebuilt-rules/rule-details/m365-portal-login-impossible-travel.asciidoc
index bd66fe66fc..cc251b7603 100644
--- a/docs/detections/prebuilt-rules/rule-details/m365-portal-login-impossible-travel.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/m365-portal-login-impossible-travel.asciidoc
@@ -7,7 +7,6 @@ Detects successful Microsoft 365 portal logins from impossible travel locations.
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-o365.audit-*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Detects successful Microsoft 365 portal logins from impossible travel locations.
 * Tactic: Initial Access
 * Resources: Investigation Guide
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
index 27e3a92001..750fc3c99b 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
@@ -7,7 +7,6 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 
 *Rule indices*: 
 
-* endgame-*
 * logs-endpoint.events.process-*
 * winlogbeat-*
 
@@ -38,7 +37,7 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 113
+*Version*: 114
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
index 56bbbd847d..995a4d42d6 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-low-malicious-probability-score.asciidoc
@@ -7,7 +7,6 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 
 *Rule indices*: 
 
-* endgame-*
 * logs-endpoint.events.process-*
 * winlogbeat-*
 
@@ -38,7 +37,7 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 11
+*Version*: 12
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
index b64afd9931..496f057926 100644
--- a/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mfa-deactivation-with-no-re-activation-for-okta-user-account.asciidoc
@@ -7,7 +7,6 @@ Detects multi-factor authentication (MFA) deactivation with no subsequent re-act
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-okta.system*
 
 *Severity*: low
@@ -36,7 +35,7 @@ Detects multi-factor authentication (MFA) deactivation with no subsequent re-act
 * Domain: Cloud
 * Resources: Investigation Guide
 
-*Version*: 416
+*Version*: 417
 
 *Rule authors*: 
 
@@ -66,7 +65,7 @@ This rule fires when an Okta user account has MFA deactivated and no subsequent
 
 - Identify the entity related to the alert by reviewing `okta.target.alternate_id`, `okta.target.id` or `user.target.full_name` fields. This should give the username of the account being targeted. Verify if MFA is deactivated for the target entity.
 - Using the `okta.target.alternate_id` field, search for MFA re-activation events where `okta.event_type` is `user.mfa.factor.activate`. Note if MFA re-activation attempts were made against the target.
-- Identify the actor performing the deactivation by reviewing `okta.actor.alternate_id`, `okta.actor.id` or `user.full_name` fields. This should give the username of the account performing the action. Determine if deactivation was performed by a separate user. 
+- Identify the actor performing the deactivation by reviewing `okta.actor.alternate_id`, `okta.actor.id` or `user.full_name` fields. This should give the username of the account performing the action. Determine if deactivation was performed by a separate user.
 - Review events where `okta.event_type` is `user.authenticate*` to determine if the actor or target accounts had suspicious login activity.
     - Geolocation details found in `client.geo*` related fields may be useful in determining if the login activity was suspicious for this user.
 - Examine related administrative activity by the actor for privilege misuse or suspicious changes.
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
index 1c7d350c47..b3a1182045 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
@@ -7,7 +7,6 @@ In Microsoft Entra ID, permissions to manage resources are assigned using roles.
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-o365.audit-*
 
 *Severity*: medium
@@ -36,7 +35,7 @@ In Microsoft Entra ID, permissions to manage resources are assigned using roles.
 * Tactic: Persistence
 * Resources: Investigation Guide
 
-*Version*: 210
+*Version*: 211
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-illicit-consent-grant-via-registered-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
index 08b6429ffb..8c1ff3d18d 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-illicit-consent-grant-via-registered-application.asciidoc
@@ -7,7 +7,6 @@ Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registe
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-o365**
 
 *Severity*: medium
@@ -38,7 +37,7 @@ Identifies an Microsoft 365 illicit consent grant request on-behalf-of a registe
 * Tactic: Initial Access
 * Tactic: Credential Access
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
index bb3a66ce05..99cfbea49f 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-oauth-phishing-via-visual-studio-code-client.asciidoc
@@ -7,7 +7,6 @@ Detects potentially suspicious OAuth authorization activity in Microsoft 365 whe
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-o365.audit-*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Detects potentially suspicious OAuth authorization activity in Microsoft 365 whe
 * Resources: Investigation Guide
 * Tactic: Initial Access
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
index 8d87604737..92961bc4ed 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-illicit-consent-grant-via-registered-application.asciidoc
@@ -7,7 +7,6 @@ Identifies an illicit consent grant request on-behalf-of a registered Entra ID a
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure*
 
 *Severity*: medium
@@ -38,7 +37,7 @@ Identifies an illicit consent grant request on-behalf-of a registered Entra ID a
 * Tactic: Initial Access
 * Tactic: Credential Access
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-user-reported-suspicious-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-user-reported-suspicious-activity.asciidoc
index e041743a08..a714d569c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-user-reported-suspicious-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-entra-id-user-reported-suspicious-activity.asciidoc
@@ -7,7 +7,6 @@ Identifies suspicious activity reported by users in Microsoft Entra ID where use
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.auditlogs-*
 
 *Severity*: medium
@@ -35,7 +34,7 @@ Identifies suspicious activity reported by users in Microsoft Entra ID where use
 * Resources: Investigation Guide
 * Tactic: Initial Access
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
index 62481e15f6..913d599b49 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -44,7 +44,7 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server w
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 312
+*Version*: 313
 
 *Rule authors*: 
 
@@ -110,8 +110,10 @@ Microsoft Exchange Server uses the worker process (w3wp.exe) to handle web reque
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
   process.parent.name : "w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
-  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-  ?process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+  (
+    (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE"))
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
index 3a8b6c6aa1..e704531143 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-graph-first-occurrence-of-client-request.asciidoc
@@ -7,7 +7,6 @@ This New Terms rule focuses on the first occurrence of a client application ID (
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.graphactivitylogs-*
 
 *Severity*: low
@@ -34,7 +33,7 @@ This New Terms rule focuses on the first occurrence of a client application ID (
 * Use Case: Identity and Access Audit
 * Tactic: Initial Access
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-management-console-file-from-unusual-path.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-management-console-file-from-unusual-path.asciidoc
index b9aa7a1f6c..94f04e1625 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-management-console-file-from-unusual-path.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-management-console-file-from-unusual-path.asciidoc
@@ -17,9 +17,9 @@ Identifies attempts to open a Microsoft Management Console File from untrusted p
 * logs-windows.sysmon_operational-*
 * winlogbeat-*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -46,7 +46,7 @@ Identifies attempts to open a Microsoft Management Console File from untrusted p
 * Resources: Investigation Guide
 * Data Source: Sysmon
 
-*Version*: 312
+*Version*: 313
 
 *Rule authors*: 
 
@@ -120,7 +120,13 @@ process where host.os.type == "windows" and event.type == "start" and
         "?:\\Windows\\System32\\*.msc",
         "?:\\Windows\\SysWOW64\\*.msc",
         "?:\\Program files\\*.msc",
-        "?:\\Program Files (x86)\\*.msc"
+        "?:\\Program Files (x86)\\*.msc",
+        "?:\\Windows\\ADFS\\Microsoft.IdentityServer.msc"
+  ) and
+  not process.command_line : (
+    "C:\\Windows\\system32\\mmc.exe eventvwr.msc /s",
+    "mmc.exe eventvwr.msc /s",
+    "\"C:\\Windows\\System32\\mmc.exe\" CompMgmt.msc*"
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
index 9938bb833d..936391800c 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
@@ -42,7 +42,7 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 213
+*Version*: 214
 
 *Rule authors*: 
 
@@ -110,30 +110,15 @@ Still, attackers can force WDigest to store the passwords insecurely on the memo
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
 
-==== Setup
-
-
-
-*Setup*
-
-
-If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
-events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
-Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
-`event.ingested` to @timestamp.
-For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
-
-
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
-registry where host.os.type == "windows" and event.type == "creation" and
-    registry.path : (
-        "HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
-        "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
-    ) and registry.data.strings : ("1", "0x00000001") and
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+    registry.value : "UseLogonCredential" and
+    registry.path : "*\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential" and
+    registry.data.strings : ("1", "0x00000001") and
     not (process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
index c4ca9def76..c7a934a90e 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-microsoft-entra-id-protection-alerts-by-user-principal.asciidoc
@@ -7,7 +7,6 @@ Identifies more than two Microsoft Entra ID Protection alerts associated to the
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.identity_protection-*
 
 *Severity*: high
@@ -37,7 +36,7 @@ Identifies more than two Microsoft Entra ID Protection alerts associated to the
 * Resources: Investigation Guide
 * Tactic: Initial Access
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
index 2f2a7c0ede..7142ffe4ba 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-okta-user-auth-events-with-same-device-token-hash-behind-a-proxy.asciidoc
@@ -7,7 +7,6 @@ Detects when Okta user authentication events are reported for multiple users wit
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-okta*
 
 *Severity*: medium
@@ -36,7 +35,7 @@ Detects when Okta user authentication events are reported for multiple users wit
 * Tactic: Credential Access
 * Resources: Investigation Guide
 
-*Version*: 209
+*Version*: 210
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-activity-to-a-suspicious-top-level-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-activity-to-a-suspicious-top-level-domain.asciidoc
index 417533599b..750558e55a 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-activity-to-a-suspicious-top-level-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-activity-to-a-suspicious-top-level-domain.asciidoc
@@ -42,7 +42,7 @@ Identifies DNS queries to commonly abused Top Level Domains by common LOLBINs or
 * Data Source: Crowdstrike
 * Data Source: Sysmon
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -104,9 +104,9 @@ network where host.os.type == "windows" and dns.question.name != null and
   process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
                   "bitsadmin.exe", "InstallUtil.exe", "python.exe", "regsvr32.exe", "dllhost.exe", "node.exe",
                   "java.exe", "javaw.exe", "*.pif", "*.com", "*.scr") or
-  ?process.code_signature.trusted != true or
+  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
   ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
-  process.executable : ("?:\\Users\\*.exe", "", "?:\\ProgramData\\*.exe")
+  process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
  ) and
 dns.question.name regex """.*\.(top|buzz|xyz|rest|ml|cf|gq|ga|onion|monster|cyou|quest|cc|bar|cfd|click|cam|surf|tk|shop|club|icu|pw|ws|online|fun|life|boats|store|hair|skin|motorcycles|christmas|lol|makeup|mom|bond|beauty|biz|live|work|zip|country|accountant|date|party|science|loan|win|men|faith|review|racing|download|host)"""
 
diff --git a/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
index 5eccf5c620..dbdceb695b 100644
--- a/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/okta-sign-in-events-via-third-party-idp.asciidoc
@@ -7,7 +7,6 @@ Detects sign-in events where authentication is carried out via a third-party Ide
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-okta*
 
 *Severity*: medium
@@ -36,7 +35,7 @@ Detects sign-in events where authentication is carried out via a third-party Ide
 * Data Source: Okta
 * Resources: Investigation Guide
 
-*Version*: 209
+*Version*: 210
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/outlook-home-page-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/outlook-home-page-registry-modification.asciidoc
index 76edfb9bbd..c0139d64ec 100644
--- a/docs/detections/prebuilt-rules/rule-details/outlook-home-page-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/outlook-home-page-registry-modification.asciidoc
@@ -45,7 +45,7 @@ Identifies modifications in registry keys associated with abuse of the Outlook H
 * Resources: Investigation Guide
 * Data Source: Crowdstrike
 
-*Version*: 206
+*Version*: 207
 
 *Rule authors*: 
 
@@ -111,7 +111,7 @@ registry where host.os.type == "windows" and event.action != "deletion" and regi
     registry.path : (
         "*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Webview\\*",
         "*\\SOFTWARE\\Microsoft\\Office\\*\\Outlook\\Today\\*"
-    ) and registry.data.strings : ("*://*", "*http*")
+    ) and registry.data.strings : ("*://*", "*:\\*")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
index 664e1d5275..f2e32db58a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-dcsync.asciidoc
@@ -3,7 +3,7 @@
 
 This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
 *Rule indices*: 
 
@@ -11,9 +11,9 @@ This rule identifies when a User Account starts the Active Directory Replication
 * logs-windows.forwarded*
 * winlogbeat-*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -43,7 +43,7 @@ This rule identifies when a User Account starts the Active Directory Replication
 * Use Case: Active Directory Monitoring
 * Data Source: Windows Security Event Logs
 
-*Version*: 219
+*Version*: 220
 
 *Rule authors*: 
 
@@ -130,30 +130,13 @@ Audit Directory Service Access (Success,Failure)
 
 [source, js]
 ----------------------------------
-any where event.code == "4662" and
-  winlog.event_data.Properties : (
-
-    /* Control Access Rights/Permissions Symbol */
-
-    "*DS-Replication-Get-Changes*",
-    "*DS-Replication-Get-Changes-All*",
-    "*DS-Replication-Get-Changes-In-Filtered-Set*",
-
-    /* Identifying GUID used in ACE */
-
-    "*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*",
-    "*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*",
-    "*89e95b76-444d-4c62-991a-0facbeda640c*")
-
-    /* The right to perform an operation controlled by an extended access right. */
-
-    and winlog.event_data.AccessMask : "0x100" and
-    not winlog.event_data.SubjectUserName : (
-          "*$", "MSOL_*", "OpenDNS_Connector", "adconnect", "SyncADConnect",
-          "SyncADConnectCM", "aadsync", "svcAzureADSync", "-"
-        )
-
-    /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */
+host.os.type:"windows" and event.code:"4662" and
+  winlog.event_data.Properties:(
+    *DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or
+    *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or
+    *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*
+  ) and winlog.event_data.AccessMask : "0x100" and
+  not winlog.event_data.SubjectUserName:(*$ or MSOL_*)
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
index fcf921739d..37be2c4d46 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
@@ -46,7 +46,7 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
 * Data Source: SentinelOne
 * Data Source: Sysmon
 
-*Version*: 318
+*Version*: 319
 
 *Rule authors*: 
 
@@ -122,7 +122,7 @@ process where host.os.type == "windows" and event.type == "start" and
   ) or
   (
     (?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
-      (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")
+      (process.args : "*MiniDump*" or process.command_line : "*comsvcs*#*24*")
   ) or
   (
     (?process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
@@ -136,7 +136,7 @@ process where host.os.type == "windows" and event.type == "start" and
       process.args : "-dumpFull" and process.args : "-attach") or
   (
     (?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
-      process.args : "create*full*") or
+      process.args : "cr*fu*") or
   (
     (?process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
 )
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
index cd7d5666a9..af35d4f794 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
@@ -13,10 +13,11 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 * endgame-*
 * logs-m365_defender.event-*
 * logs-crowdstrike.fdr*
+* logs-sentinel_one_cloud_funnel.*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -39,8 +40,9 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 * Data Source: Microsoft Defender for Endpoint
 * Resources: Investigation Guide
 * Data Source: Crowdstrike
+* Data Source: SentinelOne
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -104,29 +106,40 @@ DLL side-loading exploits the DLL search order to load malicious code into trust
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
-  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and 
-  not process.executable : ("?:\\Windows\\explorer.exe", 
-                            "?:\\Windows\\SysWOW64\\explorer.exe",
-                            "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
-                            "?:\\Program Files (x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
-                            "?:\\Windows\\System32\\Dism.exe", 
-                            "?:\\Windows\\SysWOW64\\Dism.exe",  
-                            "?:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
-                            "?:\\Windows\\System32\\inetsrv\\w3wp.exe", 
-                            "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe") and
+  (
+    process.name : ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") or
+    ?process.pe.original_file_name : ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE")
+  ) and
+  not process.executable : (
+          "\\\\?\\Volume{????????-????-????-????-????????????}\\Windows\\System32\\inetsrv\\w3wp.exe",
+          "?:\\PROGRA~?\\MICROS~?\\Office??\\winword.exe",
+          "?:\\Program Files\\Microsoft Office\\*\\winword.exe",
+          "?:\\Program Files\\Microsoft Office ??\\*\\winword.exe",
+          "?:\\Program Files\\WindowsApps\\Microsoft.Office.Desktop.*\\Office??\\winword.exe",
+          "?:\\Program Files (x86)\\Microsoft Office\\*\\winword.exe",
+          "?:\\Program Files (x86)\\Windows Kits\\*Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
+          "?:\\Windows\\explorer.exe",
+          "?:\\Windows\\System32\\Dism.exe",
+          "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+          "?:\\Windows\\SysWOW64\\Dism.exe",
+          "?:\\Windows\\SysWOW64\\explorer.exe",
+          "?:\\Windows\\SysWOW64\\inetsrv\\w3wp.exe"
+  ) and
   /* Crowdstrike specific exclusion as it uses NT Object paths */
   not
   (
     data_stream.dataset == "crowdstrike.fdr" and
     process.executable : (
-        "\\Device\\HarddiskVolume*\\Windows\\explorer.exe", 
-        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\explorer.exe",
-        "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
-        "\\Device\\HarddiskVolume*\\Program Files (x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE", 
-        "\\Device\\HarddiskVolume*\\Windows\\System32\\Dism.exe", 
-        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\Dism.exe",  
+        "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Office\\*\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Office ??\\*\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files\\WindowsApps\\Microsoft.Office.Desktop.*\\Office??\\winword.exe",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\Microsoft Office\\*\\winword.exe",
         "\\Device\\HarddiskVolume*\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\amd64\\DISM\\dism.exe",
-        "\\Device\\HarddiskVolume*\\Windows\\System32\\inetsrv\\w3wp.exe", 
+        "\\Device\\HarddiskVolume*\\Windows\\explorer.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\Dism.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\inetsrv\\w3wp.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\Dism.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\explorer.exe",
         "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\inetsrv\\w3wp.exe"
     )
   )
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-file-download-via-a-headless-browser.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-file-download-via-a-headless-browser.asciidoc
index 2e863d2909..51197c3e77 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-file-download-via-a-headless-browser.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-file-download-via-a-headless-browser.asciidoc
@@ -47,7 +47,7 @@ Identifies the use of a browser to download a file from a remote URL and from a
 * Data Source: Sysmon
 * Data Source: Crowdstrike
 
-*Version*: 206
+*Version*: 207
 
 *Rule authors*: 
 
@@ -96,12 +96,17 @@ Identifies the use of a browser to download a file from a remote URL and from a
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
- process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe", "vivaldi.exe") and
-  (process.args : "--headless*" or process.args : "data:text/html;base64,*") and
+  process.name : ("chrome.exe", "msedge.exe", "brave.exe", "browser.exe", "dragon.exe", "vivaldi.exe") and
+  process.args : "--headless*" and
+  process.args : ("--disable-gpu", "--dump-dom", "*http*", "data:text/html;base64,*") and
   process.parent.name :
      ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "conhost.exe", "msiexec.exe",
       "explorer.exe", "rundll32.exe", "winword.exe", "excel.exe", "onenote.exe", "hh.exe", "powerpnt.exe", "forfiles.exe",
-      "pcalua.exe", "wmiprvse.exe")
+      "pcalua.exe", "wmiprvse.exe") and
+  not process.executable : (
+        "?:\\inetpub\\wwwroot\\*\\ext\\modules\\html2pdf\\bin\\chrome\\*\\chrome-win64\\chrome.exe",
+        "\\Device\\HarddiskVolume*\\inetpub\\wwwroot\\*\\ext\\modules\\html2pdf\\bin\\chrome\\*\\chrome-win64\\chrome.exe"
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-malware-driven-ssh-brute-force-attempt.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-malware-driven-ssh-brute-force-attempt.asciidoc
index 091f86af70..8a12b195b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-malware-driven-ssh-brute-force-attempt.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-malware-driven-ssh-brute-force-attempt.asciidoc
@@ -30,7 +30,7 @@ This detection identifies a Linux host that has potentially been infected with m
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -136,7 +136,8 @@ from logs-endpoint.events.network-*
     event.type == "start" and
     event.action == "connection_attempted" and
     destination.port in (22, 222, 2222, 10022, 2022, 2200, 62612, 8022) and
-    not cidr_match(
+    not (
+      cidr_match(
         destination.ip,
         "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12",
         "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
@@ -144,6 +145,12 @@ from logs-endpoint.events.network-*
         "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
         "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24", "198.18.0.0/15",
         "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1", "FE80::/10", "FF00::/8"
+      ) or
+      process.executable in (
+        "/usr/bin/rclone", "/usr/bin/sss_ssh_knownhostsproxy", "/usr/sbin/sshd", "/usr/bin/ssh",
+        "/usr/local/bin/php", "/usr/sbin/apache2", "/usr/sbin/nginx", "/usr/local/bin/argocd-repo-server"
+      ) or
+      process.executable like "/usr/local/efax/*"
     )
 | stats
     Esql.event_count = count(),
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index f76baa9ea9..2c88eaf486 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -39,7 +39,7 @@ Windows contains accessibility features that may be launched with a key combinat
 * Data Source: Sysmon
 * Data Source: Microsoft Defender for Endpoint
 
-*Version*: 215
+*Version*: 216
 
 *Rule authors*: 
 
@@ -141,6 +141,7 @@ process where host.os.type == "windows" and event.type == "start" and
     "sethc.exe",
     "utilman2.exe",
     "DisplaySwitch.exe",
+    "atbroker.exe",
     "ATBroker.exe",
     "ScreenMagnifier.exe",
     "SR.exe",
@@ -149,9 +150,6 @@ process where host.os.type == "windows" and event.type == "start" and
     "MAGNIFY.EXE"
     )
 
-/* uncomment once in winlogbeat to avoid bypass with rogue process with matching pe original file name */
-/* and process.code_signature.subject_name == "Microsoft Windows" and process.code_signature.status == "trusted" */
-
 ----------------------------------
 
 *Framework*: MITRE ATT&CK^TM^
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
index 3ec5246883..ef764e3416 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -8,7 +8,7 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 *Rule indices*: 
 
 * filebeat-*
-* logs-okta*
+* logs-okta.system*
 
 *Severity*: high
 
@@ -31,12 +31,14 @@ Detects when an attacker abuses the Multi-Factor authentication mechanism by rep
 
 *Tags*: 
 
+* Domain: Identity
 * Use Case: Identity and Access Audit
 * Tactic: Credential Access
 * Data Source: Okta
+* Data Source: Okta System Logs
 * Resources: Investigation Guide
 
-*Version*: 210
+*Version*: 211
 
 *Rule authors*: 
 
@@ -93,30 +95,34 @@ This rule detects when a user denies MFA Okta Verify push notifications twice, f
 - Review and update your incident response plans and security policies based on the findings from the incident.
 
 
-==== Setup
-
-
-
-*Setup*
-
-
-The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
-
-
 ==== Rule query
 
 
 [source, js]
 ----------------------------------
 sequence by okta.actor.id with maxspan=10m
-  [authentication where event.dataset == "okta.system"
-    and okta.event_type == "user.mfa.okta_verify.deny_push"] with runs=5
-  until [authentication where event.dataset == "okta.system"
-    and (okta.event_type: (
-      "user.authentication.sso",
-      "user.authentication.auth_via_mfa",
-      "user.authentication.verify",
-      "user.session.start") and okta.outcome.result == "SUCCESS")]
+  [ any
+    where event.dataset == "okta.system"
+      and (
+        okta.event_type == "user.mfa.okta_verify.deny_push"
+        or (
+          okta.event_type == "user.authentication.auth_via_mfa"
+          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
+          and okta.outcome.reason == "INVALID_CREDENTIALS"
+        )
+      )
+  ] with runs=5
+  until
+  [ any
+    where event.dataset == "okta.system"
+      and okta.event_type in (
+        "user.authentication.sso",
+        "user.authentication.auth_via_mfa",
+        "user.authentication.verify",
+        "user.session.start"
+      )
+      and okta.outcome.result == "SUCCESS"
+  ]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-port-scanning-activity-from-compromised-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-port-scanning-activity-from-compromised-host.asciidoc
index dd64256e03..94d7a84300 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-port-scanning-activity-from-compromised-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-port-scanning-activity-from-compromised-host.asciidoc
@@ -28,7 +28,7 @@ This rule detects potential port scanning activity from a compromised host. Port
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -132,7 +132,21 @@ from logs-endpoint.events.network-*
     @timestamp > now() - 1h and
     host.os.type == "linux" and
     event.type == "start" and
-    event.action == "connection_attempted"
+    event.action == "connection_attempted" and
+    not (
+      cidr_match(destination.ip, "127.0.0.0/8", "::1", "FE80::/10", "FF00::/8") or
+      process.executable in (
+        "/opt/dbtk/bin/jsvc", "/usr/lib/dotnet/dotnet", "/usr/share/elasticsearch/jdk/bin/java", "/usr/sbin/haproxy",
+        "/usr/bin/java", "/opt/kaspersky/kesl/libexec/kesl", "/usr/bin/dotnet", "/opt/java/openjdk/bin/java"
+      ) or
+      process.executable like "/var/opt/kaspersky/kesl/*kesl" or
+      process.executable like "/usr/lib/jvm/*/java" or
+      process.executable like "/opt/google/chrome*" or
+      process.executable like "/var/lib/docker/*/java" or
+      process.executable like "/usr/lib64/jvm/*/java" or
+      process.executable like "/snap/*" or
+      process.executable like "/home/*/.local/share/JetBrains/*"
+    )
 | keep
     @timestamp,
     host.os.type,
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-author.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-author.asciidoc
index 192b7a0d49..d6a107f869 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-author.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-author.asciidoc
@@ -10,9 +10,9 @@ Detects known PowerShell offensive tooling author's name in PowerShell scripts.
 * winlogbeat-*
 * logs-windows.powershell*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -33,7 +33,7 @@ Detects known PowerShell offensive tooling author's name in PowerShell scripts.
 * Data Source: PowerShell Logs
 * Resources: Investigation Guide
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
@@ -144,7 +144,8 @@ host.os.type:windows and event.category:process and
       "jaredcatkinson" or "ChrisTruncer" or
       "monoxgas" or "TheRealWover" or
       "splinter_code"
-  )
+  ) and
+  not powershell.file.script_block_text : ("Get-UEFIDatabaseSigner" or "Posh-SSH")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
index d1d304c850..04a3cc4c95 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -35,7 +35,7 @@ Detects known PowerShell offensive tooling functions names in PowerShell scripts
 * Data Source: PowerShell Logs
 * Resources: Investigation Guide
 
-*Version*: 217
+*Version*: 218
 
 *Rule authors*: 
 
@@ -282,7 +282,7 @@ event.category:process and host.os.type:windows and
     "Invoke-SMBExec" or "Invoke-PSRemoting" or
     "Invoke-ExecuteMSBuild" or "Invoke-DCOM" or
     "Invoke-InveighRelay" or "Invoke-PsExec" or
-    "Invoke-SSHCommand" or "Find-ActiveUsersWMI" or
+    "Find-ActiveUsersWMI" or
     "Get-SystemDrivesWMI" or "Get-ActiveNICSWMI" or
     "Remove-Persistence" or "DNS_TXT_Pwnage" or
     "Execute-OnTime" or "HTTP-Backdoor" or
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2022-38028.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2022-38028.asciidoc
index cbaff60ecf..b7b1695c4e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2022-38028.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-cve-2022-38028.asciidoc
@@ -44,7 +44,7 @@ Identifies a privilege escalation attempt via exploiting CVE-2022-38028 to hijac
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 207
+*Version*: 208
 
 *Rule authors*: 
 
@@ -114,6 +114,14 @@ file where host.os.type == "windows" and event.type != "deletion" and
         "?:\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js", 
         "\\Device\\HarddiskVolume*\\*\\Windows\\system32\\DriverStore\\FileRepository\\*\\MPDW-constraints.js",
         "\\Device\\HarddiskVolume*\\*\\Windows\\WinSxS\\amd64_microsoft-windows-printing-printtopdf_*\\MPDW-constraints.js"
+    ) and
+    not process.executable : (
+          "?:\\$WINDOWS.~BT\\Sources\\SetupHost.exe",
+          "?:\\Windows\\System32\\taskhostw.exe"
+    ) and
+    not file.path : (
+        "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js",
+        "\\Device\\HarddiskVolume*\\$WINDOWS.~BT\\NewOS\\Windows\\WinSxS\\*\\MPDW-constraints.js"
     )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
index 68b7f32fb3..cea2a9cd5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-ransomware-behavior-high-count-of-readme-files-by-system.asciidoc
@@ -14,9 +14,9 @@ This rule identifies a high number (20) of file creation event by the System vir
 * logs-m365_defender.event-*
 * logs-sentinel_one_cloud_funnel.*
 
-*Severity*: high
+*Severity*: low
 
-*Risk score*: 73
+*Risk score*: 21
 
 *Runs every*: 5m
 
@@ -41,7 +41,7 @@ This rule identifies a high number (20) of file creation event by the System vir
 * Data Source: Sysmon
 * Data Source: SentinelOne
 
-*Version*: 209
+*Version*: 210
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
index 8622b16b61..403a612b1b 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-shadowing-activity.asciidoc
@@ -27,7 +27,7 @@ Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry
 
 *References*: 
 
-* https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing
+* https://blog.bitsadmin.com/spying-on-users-using-rdp-shadowing
 * https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
 
 *Tags*: 
@@ -43,7 +43,7 @@ Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 312
+*Version*: 313
 
 *Rule authors*: 
 
@@ -110,12 +110,13 @@ Remote Desktop Shadowing allows administrators to view or control active RDP ses
 
 any where host.os.type == "windows" and
 (
-  (event.category == "registry" and
-     registry.path : (
-      "HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow",
-      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow",
-      "MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow"
-    )
+  (event.category == "registry" and event.type == "change" and
+    registry.value : "Shadow" and
+    registry.path : (
+      "*\\Software\\Policies\\Microsoft\\Windows NT\\Terminal Services\\Shadow"
+    ) and
+    registry.data.strings : ("1", "0x00000001", "2", "0x00000002", "3", "0x00000003", "4", "0x00000004")
+
   ) or
   (event.category == "process" and event.type == "start" and
      (process.name : ("RdpSaUacHelper.exe", "RdpSaProxy.exe") and process.parent.name : "svchost.exe") or
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-subnet-scanning-activity-from-compromised-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-subnet-scanning-activity-from-compromised-host.asciidoc
index 1408df4603..03648046b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-subnet-scanning-activity-from-compromised-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-subnet-scanning-activity-from-compromised-host.asciidoc
@@ -28,7 +28,7 @@ This rule detects potential subnet scanning activity from a compromised host. Su
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -132,7 +132,16 @@ from logs-endpoint.events.network-*
     @timestamp > now() - 1 hours and
     host.os.type == "linux" and
     event.type == "start" and
-    event.action == "connection_attempted"
+    event.action == "connection_attempted" and
+    not (
+      process.executable in ("/usr/local/bin/prometheus", "/app/extra/chrome") or
+      process.executable like "/usr/local/prometheus/*/prometheus" or
+      process.executable like "/usr/share/elastic-agent/*" or
+      process.executable like "/var/lib/docker/overlay*connectord" or
+      process.executable like "/opt/rumble/bin/rumble-agent*" or
+      process.executable like "/opt/gitlab/*" or
+      process.executable like "/opt/google/chrome/chrome*"
+    )
 | stats
     Esql.event_count = count(),
     Esql.destination_ip_count_distinct = count_distinct(destination.ip),
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-system-tampering-via-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-system-tampering-via-file-modification.asciidoc
index 1794a8df96..2dcc6d236a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-system-tampering-via-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-system-tampering-via-file-modification.asciidoc
@@ -42,7 +42,7 @@ Identifies attempts to delete or modify critical files used during the boot proc
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -103,7 +103,7 @@ This rule identifies attempts to delete or modify critical files used during the
 file where host.os.type == "windows" and event.type in ("change", "deletion") and
  file.name : ("winload.exe", "winlod.efi", "ntoskrnl.exe", "bootmgr") and
  file.path : ("?:\\Windows\\*", "\\Device\\HarddiskVolume*\\Windows\\*") and
- not process.executable : ("?:\\Windows\\System32\\poqexec.exe", "?\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe")
+ not process.executable : ("?:\\Windows\\System32\\poqexec.exe", "\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc b/docs/detections/prebuilt-rules/rule-details/potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
new file mode 100644
index 0000000000..579c1f09c6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potentially-successful-okta-mfa-bombing-via-push-notifications.asciidoc
@@ -0,0 +1,141 @@
+[[potentially-successful-okta-mfa-bombing-via-push-notifications]]
+=== Potentially Successful Okta MFA Bombing via Push Notifications
+
+Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* filebeat-*
+* logs-okta.system*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mandiant.com/resources/russian-targeting-gov-business
+* https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy
+* https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
+* https://www.rezonate.io/blog/okta-logs-decoded-unveiling-identity-threats-through-threat-hunting/
+* https://www.elastic.co/security-labs/monitoring-okta-threats-with-elastic-security
+* https://www.elastic.co/security-labs/starter-guide-to-understanding-okta
+
+*Tags*: 
+
+* Domain: Identity
+* Use Case: Identity and Access Audit
+* Tactic: Credential Access
+* Data Source: Okta
+* Data Source: Okta System Logs
+* Resources: Investigation Guide
+
+*Version*: 417
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potentially Successful Okta MFA Bombing via Push Notifications*
+
+
+Multi-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.
+
+This rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.
+
+
+*Possible investigation steps:*
+
+
+- Identify the user who received the MFA notifications by reviewing the `user.email` field.
+- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.
+- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.
+- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.
+- Check if the MFA requests and the successful login occurred during the user's regular activity hours.
+- Look for any other suspicious activity on the account around the same time.
+- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.
+
+
+*False positive analysis:*
+
+
+- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.
+- Check if there are known issues with the MFA system causing false denials.
+
+
+*Response and remediation:*
+
+
+- If unauthorized access is confirmed, initiate your incident response process.
+- Alert the user and your IT department immediately.
+- If possible, isolate the user's account until the issue is resolved.
+- Investigate the source of the unauthorized access.
+- If the account was accessed by an unauthorized party, determine the actions they took after logging in.
+- Consider enhancing your MFA policy to prevent such incidents in the future.
+- Encourage users to report any unexpected MFA notifications immediately.
+- Review and update your incident response plans and security policies based on the findings from the incident.
+
+==== Setup
+
+
+The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by okta.actor.id with maxspan=10m
+  [ any
+    where event.dataset == "okta.system"
+      and (
+        okta.event_type == "user.mfa.okta_verify.deny_push"
+        or (
+          okta.event_type == "user.authentication.auth_via_mfa"
+          and okta.debug_context.debug_data.factor == "OKTA_VERIFY_PUSH"
+          and okta.outcome.reason == "INVALID_CREDENTIALS"
+        )
+      )
+  ] with runs=5
+  [ any
+    where event.dataset == "okta.system"
+      and okta.event_type in (
+        "user.authentication.sso",
+        "user.authentication.auth_via_mfa",
+        "user.authentication.verify",
+        "user.session.start"
+      )
+      and okta.outcome.result == "SUCCESS"
+  ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Multi-Factor Authentication Request Generation
+** ID: T1621
+** Reference URL: https://attack.mitre.org/techniques/T1621/
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
index 52502dd820..af866f9df4 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-kerberos-ticket-request.asciidoc
@@ -10,9 +10,9 @@ Detects PowerShell scripts that have the capability of requesting kerberos ticke
 * winlogbeat-*
 * logs-windows.powershell*
 
-*Severity*: medium
+*Severity*: high
 
-*Risk score*: 47
+*Risk score*: 73
 
 *Runs every*: 5m
 
@@ -34,7 +34,7 @@ Detects PowerShell scripts that have the capability of requesting kerberos ticke
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 215
+*Version*: 216
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
index f7957a1d15..fd031496dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-mailbox-collection-script.asciidoc
@@ -34,7 +34,7 @@ Detects PowerShell scripts that can be used to collect data from mailboxes. Adve
 * Data Source: PowerShell Logs
 * Resources: Investigation Guide
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
@@ -129,16 +129,23 @@ reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
 ----------------------------------
 event.category:process and host.os.type:windows and
   (
-   powershell.file.script_block_text : (
-      "Microsoft.Office.Interop.Outlook" or
-      "Interop.Outlook.olDefaultFolders" or
-      "::olFolderInBox"
-   ) or
-   powershell.file.script_block_text : (
-      "Microsoft.Exchange.WebServices.Data.Folder" or
-      "Microsoft.Exchange.WebServices.Data.FileAttachment"
-   )
-  ) and not user.id : "S-1-5-18"
+    (
+      powershell.file.script_block_text : (
+        "Microsoft.Office.Interop.Outlook" or
+        "Interop.Outlook.olDefaultFolders" or
+        "olFolderInBox" or
+        "Outlook.Application"
+      ) and powershell.file.script_block_text : ("MAPI" or "GetDefaultFolder" or "GetNamespace" or "Session" or "GetSharedDefaultFolder")
+    ) or
+    (
+      powershell.file.script_block_text : (
+        "Microsoft.Exchange.WebServices.Data.Folder" or
+        "Microsoft.Exchange.WebServices.Data.FileAttachment" or
+        "Microsoft.Exchange.WebServices.Data.ExchangeService"
+      ) and
+      powershell.file.script_block_text : ("FindItems" or "Bind" or "WellKnownFolderName" or "FolderId" or "ItemView" or "PropertySet" or "SearchFilter" or "Attachments")
+    )
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
index be394c4a5e..cb2917bff4 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-password-policy-discovery-capabilities.asciidoc
@@ -32,7 +32,7 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
@@ -99,14 +99,12 @@ event.category: "process" and host.os.type:windows and
       )
     )
   )
-) and not powershell.file.script_block_text : (
-    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
-  )
-  and not 
-  (
-    powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml")
-  )
-  and not user.id : "S-1-5-18"
+) and
+
+not powershell.file.script_block_text : ("sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators") and
+not powershell.file.script_block_text : ("43c15630-959c-49e4-a977-758c5cc93408" and "CmdletsToExport" and "ActiveDirectory.Types.ps1xml") and
+not file.directory: "C:\Program Files\LogicMonitor\Agent\tmp" and
+not user.id : "S-1-5-18"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-windows-defender-tampering-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-windows-defender-tampering-capabilities.asciidoc
index 22312a9bec..d551f89337 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-windows-defender-tampering-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-windows-defender-tampering-capabilities.asciidoc
@@ -29,9 +29,9 @@ Identifies PowerShell scripts containing cmdlets and parameters that attackers c
 * Use Case: Threat Detection
 * Tactic: Defense Evasion
 * Data Source: PowerShell Logs
-* Rule Type: BBR
+* Resources: Investigation Guide
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
@@ -40,6 +40,62 @@ Identifies PowerShell scripts containing cmdlets and parameters that attackers c
 *Rule license*: Elastic License v2
 
 
+==== Investigation guide
+
+
+ ## Triage and analysis
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating PowerShell Script with Windows Defender Tampering Capabilities*
+
+
+PowerShell is a powerful scripting language used for task automation and configuration management in Windows environments. Adversaries exploit PowerShell to disable Windows Defender features, reducing detection risks. The detection rule identifies scripts attempting to modify Defender settings, such as disabling real-time monitoring, by analyzing script block text for specific cmdlets and parameters, while excluding legitimate processes and users.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script's execution context, such as the user account, privileges, the role of the system on which it was executed, and any relevant timestamps.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate the origin of the PowerShell script, including its source, download method, and any associated URLs or IP addresses.
+- Use the Get-MpPreference cmdlet to check defender settings for the host. Revert them to the desired state if needed.
+- Check for Files written and executed after the settings were changed.
+
+
+*False positive analysis*
+
+
+- Legitimate administrative scripts may trigger the rule if they use Set-MpPreference cmdlets for valid configuration changes. To handle this, review the script's purpose and source, and consider adding exceptions for trusted scripts or users.
+- Automated system management tools might use similar cmdlets for routine maintenance. Identify these tools and exclude their processes or directories from the rule to prevent unnecessary alerts.
+- Security software updates or installations could temporarily disable certain Defender features. Monitor these activities and whitelist known update processes to avoid false positives.
+- PowerShell scripts executed by system administrators for troubleshooting may appear suspicious. Verify the user ID and script content, and exclude known administrator accounts from the rule if they frequently perform such tasks.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
 ==== Setup
 
 
@@ -86,7 +142,8 @@ not powershell.file.script_block_text : (
   ("cmdletization" and "cdxml-Help.xml") or
   ("function Set-MpPreference" and "Microsoft.PowerShell.Cmdletization.GeneratedTypes.MpPreference.SubmitSamplesConsentType")
 ) and
-not file.directory : "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM"
+not file.directory : "C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\SenseCM" and
+not user.id : "S-1-5-18"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
index dab2fe534b..243e50e504 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-share-enumeration-script.asciidoc
@@ -10,9 +10,9 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 * winlogbeat-*
 * logs-windows.powershell*
 
-*Severity*: medium
+*Severity*: high
 
-*Risk score*: 47
+*Risk score*: 73
 
 *Runs every*: 5m
 
@@ -37,7 +37,7 @@ Detects scripts that contain PowerShell functions, structures, or Windows API fu
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 113
+*Version*: 114
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
index 35da8e9833..1c52b1375d 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-audio-capture-capabilities.asciidoc
@@ -10,9 +10,9 @@ Detects PowerShell scripts that can record audio, a common feature in popular po
 * winlogbeat-*
 * logs-windows.powershell*
 
-*Severity*: medium
+*Severity*: high
 
-*Risk score*: 47
+*Risk score*: 73
 
 *Runs every*: 5m
 
@@ -33,7 +33,7 @@ Detects PowerShell scripts that can record audio, a common feature in popular po
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 214
+*Version*: 215
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
index f4a5939190..4a528f4e9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -34,7 +34,7 @@ Detects PowerShell scripts that can get the contents of the clipboard, which att
 * Data Source: PowerShell Logs
 * Resources: Investigation Guide
 
-*Version*: 212
+*Version*: 213
 
 *Rule authors*: 
 
@@ -141,7 +141,7 @@ event.category:process and host.os.type:windows and
   ) and
   not user.id : "S-1-5-18" and
   not (
-    file.path : C\:\\Program?Files\\WindowsPowerShell\\*Modules*.ps1 and
+    file.path : *WindowsPowerShell\\Modules\\*.ps1 and
     file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
   )
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
index 345e8ab049..add8b68600 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
@@ -43,7 +43,7 @@ Identifies a privilege escalation attempt via a rogue Windows directory (Windir)
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 312
+*Version*: 313
 
 *Rule authors*: 
 
@@ -108,7 +108,7 @@ The Windir environment variable points to the Windows directory, crucial for sys
 [source, js]
 ----------------------------------
 registry where host.os.type == "windows" and event.type == "change" and
-registry.value : ("windir", "systemroot") and
+registry.value : ("windir", "systemroot") and registry.data.strings != null and
 registry.path : (
     "*\\Environment\\windir",
     "*\\Environment\\systemroot"
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 16e13462b4..7d0716e33d 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -35,7 +35,7 @@ Identifies the execution of a file that was created by the virtual system proces
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 119
+*Version*: 120
 
 *Rule authors*: 
 
@@ -116,52 +116,31 @@ sequence with maxspan=1m
    process.pid == 4 and (file.extension : "exe" or file.Ext.header_bytes : "4d5a*")] by host.id, file.path
   [process where host.os.type == "windows" and event.type == "start" and
     not (
-      /* Veeam related processes */
       (
-        process.name : (
-          "VeeamGuestHelper.exe", "VeeamGuestIndexer.exe", "VeeamAgent.exe", "VeeamLogShipper.exe",
-          "Veeam.VSS.Sharepoint20??.exe", "OracleProxy.exe", "Veeam.SQL.Service", "VeeamDeploymentSvc.exe"
-        ) and process.code_signature.trusted == true and process.code_signature.subject_name : "Veeam Software Group GmbH"
+        process.code_signature.trusted == true and
+        process.code_signature.subject_name : (
+              "Veeam Software Group GmbH",
+              "Elasticsearch, Inc.",
+              "PDQ.com Corporation",
+              "CrowdStrike, Inc.",
+              "Microsoft Windows Hardware Compatibility Publisher",
+              "ZOHO Corporation Private Limited",
+              "BeyondTrust Corporation", 
+              "CyberArk Software Ltd.", 
+              "Sophos Ltd"
+        )
       ) or
-      /* PDQ related processes */
       (
-        process.name : (
-          "PDQInventoryScanner.exe", "PDQInventoryMonitor.exe", "PDQInventory-Scanner-?.exe",
-          "PDQInventoryWakeCommand-?.exe", "PDQDeployRunner-?.exe"
-        ) and process.code_signature.trusted == true and process.code_signature.subject_name : "PDQ.com Corporation"
-      ) or
-      /* CrowdStrike related processes */
-      (
-        (process.executable : "?:\\Windows\\System32\\drivers\\CrowdStrike\\*Sensor*.exe" and 
-         process.code_signature.trusted == true and process.code_signature.subject_name : "CrowdStrike, Inc.") or
-        (process.executable : "?:\\Windows\\System32\\drivers\\CrowdStrike\\*-CsInstallerService.exe" and 
-         process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Windows Hardware Compatibility Publisher")
-      ) or
-      /* MS related processes */
-      (
-        process.executable == "System" or
-        (process.executable : "?:\\Windows\\ccmsetup\\ccmsetup.exe" and 
-         process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation")
+        process.executable : (
+          "?:\\Windows\\ccmsetup\\ccmsetup.exe",
+          "?:\\Windows\\SoftwareDistribution\\Download\\Install\\AM_Delta*.exe",
+          "?:\\Windows\\CAInvokerService.exe"
+        ) and process.code_signature.trusted == true
       ) or
-      /* CyberArk processes */
-      (
-        process.executable : "?:\\Windows\\CAInvokerService.exe" and 
-        process.code_signature.trusted == true and process.code_signature.subject_name : "CyberArk Software Ltd."
-      )  or
-      /* Sophos processes */
       (
-        process.executable : "?:\\ProgramData\\Sophos\\AutoUpdate\\Cache\\sophos_autoupdate1.dir\\SophosUpdate.exe" and 
-        process.code_signature.trusted == true and process.code_signature.subject_name : "Sophos Ltd"
-      )  or
-      /* Elastic processes */
-      (
-        process.executable : (
-          "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\previous\\elastic-endpoint.exe",
-          "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\elastic-agent.exe",
-          "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\agentbeat.exe"
-        ) and 
-        process.code_signature.trusted == true and process.code_signature.subject_name : "Elasticsearch, Inc."
-      ) 
+        process.executable : "G:\\SMS_*\\srvboot.exe" and 
+        process.code_signature.trusted == true and process.code_signature.subject_name : "Microsoft Corporation"
+      )
     )
   ] by host.id, process.executable
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index e9ea49a772..f42c2f88a6 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -31,7 +31,7 @@ Identifies powershell.exe being used to download an executable file from an untr
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 113
+*Version*: 114
 
 *Rule authors*: 
 
@@ -116,18 +116,29 @@ PowerShell is one of system administrators' main tools for automation, report ro
 [source, js]
 ----------------------------------
 sequence by process.entity_id with maxspan=30s
-
-[network where host.os.type == "windows" and
-  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and network.protocol == "dns" and
-   not dns.question.name : (
-          "localhost", "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com",
-          "*.windowsupdate.com", "metadata.google.internal", "dist.nuget.org",
-          "artifacts.elastic.co", "*.digicert.com", "packages.chocolatey.org",
-          "outlook.office365.com"
-       ) and not user.id : "S-1-5-18"]
+[network where host.os.type == "windows" and 
+  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+  network.protocol == "dns" and
+  not dns.question.name : (
+        "*.microsoft.com", "*.azureedge.net", "*.powershellgallery.com", "*.windowsupdate.com",
+        "metadata.google.internal", "dist.nuget.org", "artifacts.elastic.co", "*.digicert.com",
+        "*.chocolatey.org", "outlook.office365.com", "cdn.oneget.org", "ci.dot.net",
+        "packages.icinga.com", "login.microsoftonline.com", "*.gov", "*.azure.com", "*.python.org",
+        "dl.google.com", "sensor.cloud.tenable.com", "*.azurefd.net", "*.office.net", "*.anac*",
+        "aka.ms", "dot.net", "*.visualstudio.com", "*.local") and
+  not user.id == "S-1-5-18" and
+  /* Filter out NetBIOS/LLMNR-style names (e.g. host, localhost, etc.) */
+  dns.question.name regex """.*\.[a-zA-Z]{2,5}"""]
 [file where host.os.type == "windows" and event.type == "creation" and
-  process.name : "powershell.exe" and file.extension : ("exe", "dll", "ps1", "bat") and
-  not file.name : "__PSScriptPolicy*.ps1"]
+  process.name : "powershell.exe" and 
+  (file.extension : ("exe", "dll", "ps1", "bat") or file.Ext.header_bytes : "4d5a*") and
+  not file.name : "__PSScriptPolicy*.ps1" and
+  not file.path : (
+        "?:\\Users\\*\\AppData\\Local\\Temp\\????????.dll",
+        "?:\\Users\\*\\AppData\\Local\\Temp\\*\\????????.dll",
+        "?:\\Windows\\TEMP\\ansible-tmp-*\\AnsiballZ*.ps1"
+  ) and
+  not user.id == "S-1-5-18"]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
index 13fa719b88..effb3dfd4e 100644
--- a/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
@@ -47,7 +47,7 @@ Identifies suspicious processes being spawned by the ScreenConnect server proces
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 207
+*Version*: 208
 
 *Rule authors*: 
 
@@ -113,7 +113,7 @@ ScreenConnect, a remote support tool, allows administrators to control systems r
 process where host.os.type == "windows" and event.type == "start" and
   process.parent.name : "ScreenConnect.Service.exe" and
   (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "csc.exe") or
-  ?process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+  ?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE"))
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
index af3e8ac801..0971ec9734 100644
--- a/docs/detections/prebuilt-rules/rule-details/successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/successful-ssh-authentication-from-unusual-ssh-public-key.asciidoc
@@ -8,7 +8,6 @@ This rule leverages the new_terms rule type to detect successful SSH authenticat
 *Rule indices*: 
 
 * logs-system.auth-*
-* filebeat-*
 
 *Severity*: low
 
@@ -31,7 +30,7 @@ This rule leverages the new_terms rule type to detect successful SSH authenticat
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
index db601988f6..efb9c36c7a 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
@@ -11,9 +11,9 @@ Identify read access to a high number of Active Directory object attributes. The
 * logs-windows.forwarded*
 * winlogbeat-*
 
-*Severity*: high
+*Severity*: low
 
-*Risk score*: 73
+*Risk score*: 21
 
 *Runs every*: 5m
 
@@ -34,7 +34,7 @@ Identify read access to a high number of Active Directory object attributes. The
 * Data Source: Windows
 * Resources: Investigation Guide
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
index bd56bd458d..0502e28810 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-email-access-by-first-party-application-via-microsoft-graph.asciidoc
@@ -7,7 +7,6 @@ Identifies access to email resources via Microsoft Graph API using an first-part
 
 *Rule indices*: 
 
-* filebeat-*
 * logs-azure.graphactivitylogs-*
 
 *Severity*: medium
@@ -36,7 +35,7 @@ Identifies access to email resources via Microsoft Graph API using an first-part
 * Tactic: Collection
 * Resources: Investigation Guide
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
index cfbe0782e3..40e76a7907 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
@@ -47,7 +47,7 @@ Identifies the execution of a process with arguments pointing to the INetCache F
 * Data Source: Crowdstrike
 * Resources: Investigation Guide
 
-*Version*: 209
+*Version*: 210
 
 *Rule authors*: 
 
@@ -113,13 +113,25 @@ The INetCache folder stores temporary internet files, which can be exploited by
 process where host.os.type == "windows" and event.type == "start" and
   process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
   (
-    process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
+    process.args : "*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
     process.executable : (
       "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*",
 
-      /* Crowdstrike specific exclusion as it uses NT Object paths */
+      /* Crowdstrike specific condition as it uses NT Object paths */
       "\\Device\\HarddiskVolume*\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*"
     )
+  ) and
+  not process.executable : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Windows\\System32\\mspaint.exe",
+        "?:\\Windows\\System32\\notepad.exe",
+
+        /* Crowdstrike specific exclusion as it uses NT Object paths */
+        "\\Device\\HarddiskVolume*\\Program Files\\*.exe",
+        "\\Device\\HarddiskVolume*\\Program Files (x86)\\*.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\mspaint.exe",
+        "\\Device\\HarddiskVolume*\\Windows\\System32\\notepad.exe"
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-antimalware-service-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-antimalware-service-execution.asciidoc
new file mode 100644
index 0000000000..7a3bdc8aab
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-antimalware-service-execution.asciidoc
@@ -0,0 +1,144 @@
+[[suspicious-microsoft-antimalware-service-execution]]
+=== Suspicious Microsoft Antimalware Service Execution
+
+Identifies suspicious execution of the Microsoft Antimalware Service Executable (MsMpEng.exe) from non-standard paths or renamed instances. This may indicate an attempt to evade defenses through DLL side-loading or by masquerading as the antimalware process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+* logs-m365_defender.event-*
+* logs-crowdstrike.fdr*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Crowdstrike
+* Resources: Investigation Guide
+
+*Version*: 216
+
+*Rule authors*: 
+
+* Elastic
+* Dennis Perto
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+> **Disclaimer**:
+> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
+
+
+*Investigating Suspicious Microsoft Antimalware Service Execution*
+
+
+The Microsoft Antimalware Service Executable, a core component of Windows Defender, is crucial for real-time protection against malware. Adversaries exploit its trust by renaming it or executing it from non-standard paths to load malicious DLLs, bypassing security measures. The detection rule identifies such anomalies by monitoring process names and paths, flagging deviations from expected behavior to uncover potential threats.
+
+
+*Possible investigation steps*
+
+
+- Review the process details to confirm if the process name is MsMpEng.exe but is executing from a non-standard path. Check the process.executable field to identify the exact path and verify if it deviates from the expected directories.
+- Investigate the parent process of the suspicious MsMpEng.exe instance to determine how it was initiated. This can provide insights into whether the process was started by a legitimate application or a potentially malicious one.
+- Examine the system for any recent file modifications or creations in the directory where the suspicious MsMpEng.exe is located. This can help identify if a malicious DLL was recently placed in the same directory.
+- Check for any network connections or communications initiated by the suspicious MsMpEng.exe process. This can help determine if the process is attempting to communicate with external servers, which may indicate malicious activity.
+- Look for any other processes or activities on the host that may indicate compromise, such as unusual user account activity or other processes running from unexpected locations. This can help assess the broader impact of the potential threat.
+
+
+*False positive analysis*
+
+
+- Legitimate software updates or installations may temporarily rename or relocate the Microsoft Antimalware Service Executable. Users should verify if any software updates or installations occurred around the time of the alert and consider excluding these paths if they are known and trusted.
+- Custom security or IT management tools might execute the executable from non-standard paths for monitoring or testing purposes. Confirm with IT or security teams if such tools are in use and add these paths to the exclusion list if they are verified as safe.
+- Virtualization or sandbox environments may replicate the executable in different locations for testing or analysis. Check if the environment is part of a controlled setup and exclude these paths if they are part of legitimate operations.
+- Backup or recovery processes might involve copying the executable to alternate locations. Ensure these processes are legitimate and consider excluding these paths if they are part of routine operations.
+
+
+*Response and remediation*
+
+
+- Immediately isolate the affected system from the network to prevent further spread of the potential threat.
+- Terminate any suspicious processes identified by the detection rule, specifically those involving MsMpEng.exe running from non-standard paths.
+- Conduct a thorough scan of the affected system using an updated antivirus or endpoint detection and response (EDR) tool to identify and remove any malicious DLLs or other malware.
+- Review and restore any altered or deleted system files from a known good backup to ensure system integrity.
+- Investigate the source of the DLL side-loading attempt to determine if it was part of a broader attack campaign, and gather forensic evidence for further analysis.
+- Escalate the incident to the security operations center (SOC) or incident response team for a deeper investigation and to assess the need for further containment measures.
+- Implement additional monitoring and alerting for similar anomalies in process execution paths to enhance detection capabilities and prevent recurrence.
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or
+  (
+    process.name : "MsMpEng.exe" and
+    not process.executable : (
+            "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+            "?:\\Program Files\\Windows Defender\\*.exe",
+            "?:\\Program Files (x86)\\Windows Defender\\*.exe",
+            "?:\\Program Files\\Microsoft Security Client\\*.exe",
+            "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe",
+
+            /* Crowdstrike specific exclusion as it uses NT Object paths */
+            "\\Device\\HarddiskVolume*\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files (x86)\\Windows Defender\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files\\Microsoft Security Client\\*.exe",
+            "\\Device\\HarddiskVolume*\\Program Files (x86)\\Microsoft Security Client\\*.exe"
+    )
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
index 9ac336c2cc..6d4a7f3563 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -44,7 +44,7 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 214
+*Version*: 215
 
 *Rule authors*: 
 
@@ -110,8 +110,7 @@ The Microsoft Diagnostics Troubleshooting Wizard (MSDT) is a legitimate tool use
 process where host.os.type == "windows" and event.type == "start" and
   (?process.pe.original_file_name == "msdt.exe" or process.name : "msdt.exe") and
   (
-    process.args : ("IT_RebrowseForFile=*", "ms-msdt:/id", "ms-msdt:-id", "*FromBase64*") or
-
+    process.args : ("IT_RebrowseForFile=*", "*FromBase64*", "*/../../../*", "*PCWDiagnostic*") or
     (
       process.args : "-af" and process.args : "/skip" and
       process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index 348feab416..9c4a54502d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -45,7 +45,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 317
+*Version*: 318
 
 *Rule authors*: 
 
@@ -153,7 +153,9 @@ registry where host.os.type == "windows" and event.type == "change" and
            "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
            "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
            "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
-           "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
+           "%%USERPROFILE%%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "\\\\*"
            )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/system-file-ownership-change.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-file-ownership-change.asciidoc
new file mode 100644
index 0000000000..c654272104
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/system-file-ownership-change.asciidoc
@@ -0,0 +1,131 @@
+[[system-file-ownership-change]]
+=== System File Ownership Change
+
+Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-crowdstrike.fdr*
+* logs-endpoint.events.process-*
+* logs-m365_defender.event-*
+* logs-sentinel_one_cloud_funnel.*
+* logs-system.security*
+* logs-windows.forwarded*
+* logs-windows.sysmon_operational-*
+* winlogbeat-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Windows Security Event Logs
+* Data Source: Microsoft Defender for Endpoint
+* Data Source: Sysmon
+* Data Source: SentinelOne
+* Data Source: Crowdstrike
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating System File Ownership Change*
+
+
+Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
+
+
+*Possible investigation steps*
+
+
+- Assess the ownership target file or directory and identify if it's a system critical file.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- System updates, backup software and uninstallers tend to modify files ownership.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+   (process.name : "icacls.exe" and process.args : "/reset") or
+   (process.name : "takeown.exe" and process.args : "/f") or
+   (process.name : "icacls.exe" and process.args : "/grant" and process.args : "Everyone:F")
+   ) and
+   process.command_line : "*.exe *C:\\Windows\\*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
+* Sub-technique:
+** Name: Windows File and Directory Permissions Modification
+** ID: T1222.001
+** Reference URL: https://attack.mitre.org/techniques/T1222/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/system-public-ip-discovery-via-dns-query.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-public-ip-discovery-via-dns-query.asciidoc
index 24f70b2ee0..cc74336f4b 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-public-ip-discovery-via-dns-query.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-public-ip-discovery-via-dns-query.asciidoc
@@ -43,7 +43,7 @@ Identifies DNS queries to known public IP address lookup web services. Malwares
 * Data Source: Crowdstrike
 * Data Source: Sysmon
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
@@ -100,17 +100,17 @@ Identifies DNS queries to known public IP address lookup web services. Malwares
 
 [source, js]
 ----------------------------------
-network where host.os.type == "windows" and dns.question.name != null and
+network where host.os.type == "windows" and dns.question.name != null and process.name != null and
 (
   process.name : ("MSBuild.exe", "mshta.exe", "wscript.exe", "powershell.exe", "pwsh.exe", "msiexec.exe", "rundll32.exe",
   "bitsadmin.exe", "InstallUtil.exe", "RegAsm.exe", "vbc.exe", "RegSvcs.exe", "python.exe", "regsvr32.exe", "dllhost.exe",
   "node.exe", "javaw.exe", "java.exe", "*.pif", "*.com") or
 
-  ?process.code_signature.trusted != true or
+  (?process.code_signature.trusted == false or ?process.code_signature.exists == false) or
 
   ?process.code_signature.subject_name : ("AutoIt Consulting Ltd", "OpenJS Foundation", "Python Software Foundation") or
 
-  ?process.executable : ("?:\\Users\\*.exe", "", "?:\\ProgramData\\*.exe",  "?\\Device\\HarddiskVolume?\\Users\\*.exe",  "?\\Device\\HarddiskVolume?\\ProgramData\\*.exe")
+  ?process.executable : ("?:\\Users\\*.exe", "?:\\ProgramData\\*.exe")
  ) and
  dns.question.name :
          (
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 5379bf0536..177d9bca02 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -33,7 +33,7 @@ Identifies attempt to load an untrusted driver. Adversaries may modify code sign
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 12
+*Version*: 13
 
 *Rule authors*: 
 
@@ -123,7 +123,7 @@ This rule identifies an attempt to load an untrusted driver, which effectively m
 [source, js]
 ----------------------------------
 driver where host.os.type == "windows" and process.pid == 4 and
-  dll.code_signature.trusted != true and 
+  (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
   not dll.code_signature.status : ("errorExpired", "errorRevoked", "errorCode_endpoint:*")
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
index 8e9aea0de3..ebdc2e42f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -42,7 +42,7 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 * Data Source: SentinelOne
 * Resources: Investigation Guide
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -108,7 +108,7 @@ In Windows environments, the System process (PID 4) is a critical component resp
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
   process.parent.pid == 4 and process.executable : "?*" and
-  not process.executable : ("Registry", "MemCompression", "?:\\Windows\\System32\\smss.exe")
+  not process.executable : ("Registry", "MemCompression", "?:\\Windows\\System32\\smss.exe", "HotPatch")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
index 21471adc10..bfea0c62ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
@@ -50,7 +50,7 @@ Identifies an unexpected process spawning from dns.exe, the process responsible
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -114,8 +114,16 @@ This rule looks for unusual children of the `dns.exe` process, which can indicat
 
 [source, js]
 ----------------------------------
-process where host.os.type == "windows" and event.type == "start" and process.parent.name : "dns.exe" and
-  not process.name : "conhost.exe"
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "dns.exe" and
+  not process.executable : (
+    "?:\\Windows\\System32\\conhost.exe",
+
+    /* Crowdstrike specific exclusion as it uses NT Object paths */
+    "\\Device\\HarddiskVolume*\\Windows\\System32\\conhost.exe",
+    "\\Device\\HarddiskVolume*\\Program Files\\ReasonLabs\\*"
+  ) and
+  not ?process.parent.executable : "?:\\Program Files\\ReasonLabs\\DNS\\ui\\DNS.exe"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-command-execution-from-web-server-parent.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-command-execution-from-web-server-parent.asciidoc
index 16ce762a69..e0b3be7137 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-command-execution-from-web-server-parent.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-command-execution-from-web-server-parent.asciidoc
@@ -30,7 +30,7 @@ This rule detects potential command execution from a web server parent process o
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -155,20 +155,30 @@ from logs-endpoint.events.process-*
     host.os.type == "linux" and
     event.type == "start" and
     event.action == "exec" and (
+      (
         process.parent.name in (
             "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
             "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
             "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
         ) or
-        process.parent.name like "php-*" or
-        process.parent.name like "python*" or
-        process.parent.name like "ruby*" or
-        process.parent.name like "perl*" or
         user.name in (
             "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
         ) or
         user.id in ("99", "33", "498", "48") or
         process.working_directory like "/var/www/*"
+      ) or
+      (
+        (
+          process.parent.name like "php-*" or
+          process.parent.name like "python*" or
+          process.parent.name like "ruby*" or
+          process.parent.name like "perl*"
+        ) and (
+          process.working_directory like "/var/www/*" or
+          process.working_directory like "/srv/www/*" or
+          process.working_directory like "/usr/share/nginx/*"
+        )
+      )
     ) and
     process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and
     process.command_line like "* -c *" and not (
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-execution-via-microsoft-common-console-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-execution-via-microsoft-common-console-file.asciidoc
index e99b8d6f26..92dbaeeff0 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-execution-via-microsoft-common-console-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-execution-via-microsoft-common-console-file.asciidoc
@@ -42,7 +42,7 @@ Identifies the execution of a child process from a Microsoft Common Console file
 * Data Source: Microsoft Defender for Endpoint
 * Data Source: SentinelOne
 
-*Version*: 204
+*Version*: 205
 
 *Rule authors*: 
 
@@ -91,8 +91,33 @@ Identifies the execution of a child process from a Microsoft Common Console file
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
- process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and endswith~(process.parent.args, ".msc") and
- not process.parent.args : ("?:\\Windows\\System32\\*.msc", "?:\\Windows\\SysWOW64\\*.msc", "?:\\Program files\\*.msc", "?:\\Program Files (x86)\\*.msc")
+  process.parent.executable : "?:\\Windows\\System32\\mmc.exe" and endswith~(process.parent.args, ".msc") and
+  not (
+    process.parent.args : (
+      "?:\\Windows\\System32\\*.msc",
+      "?:\\Windows\\SysWOW64\\*.msc",
+      "?:\\Program files\\*.msc",
+      "?:\\Program Files (x86)\\*.msc"
+    ) or
+    (
+      process.executable : "?:\\Windows\\System32\\mmc.exe" and
+      process.command_line : "\"C:\\WINDOWS\\system32\\mmc.exe\" \"C:\\Windows\\System32\\gpme.msc\" /s /gpobject:\"LDAP://*"
+    ) or
+    (
+      process.executable : (
+        "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+        "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+        "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "?:\\Program Files\\internet explorer\\iexplore.exe"
+      ) and
+      process.args : "http*://go.microsoft.com/fwlink/*"
+    ) or
+    process.executable : (
+      "?:\\Windows\\System32\\vmconnect.exe",
+      "?:\\Windows\\System32\\WerFault.exe",
+      "?:\\Windows\\System32\\wermgr.exe"
+    )
+  )
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-operation-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-operation-by-dns-exe.asciidoc
new file mode 100644
index 0000000000..410d2995e8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-operation-by-dns-exe.asciidoc
@@ -0,0 +1,71 @@
+[[unusual-file-operation-by-dns-exe]]
+=== Unusual File Operation by dns.exe
+
+Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 215
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category : "file" and host.os.type : "windows" and
+  event.type : ("creation" or "deletion" or "change") and process.name : "dns.exe" and
+  not file.extension : ("old" or "temp" or "bak" or "dns" or "arpa" or "log")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-transfer-utility-launched.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-transfer-utility-launched.asciidoc
index 41d2bff6ca..821941e1c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-transfer-utility-launched.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-transfer-utility-launched.asciidoc
@@ -29,7 +29,7 @@ This rule leverages ESQL to detect the execution of unusual file transfer utilit
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -129,7 +129,7 @@ For more details on Elastic Defend refer to the https://www.elastic.co/guide/en/
 [source, js]
 ----------------------------------
 from logs-endpoint.events.process-*
-| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, process.command_line, agent.id, host.name
+| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, agent.id, host.name
 | where
     @timestamp > now() - 1 hours and
     host.os.type == "linux" and
@@ -141,7 +141,7 @@ from logs-endpoint.events.process-*
     Esql.agent_id_count_distinct = count_distinct(agent.id),
     Esql.host_name_values = values(host.name),
     Esql.agent_id_values = values(agent.id)
-  by process.executable, process.parent.executable, process.command_line
+  by process.executable, process.parent.executable
 | where
     Esql.agent_id_count_distinct == 1 and
     Esql.event_count < 5
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-from-web-server-parent.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-from-web-server-parent.asciidoc
index cc92e3dd5f..aabd676c9b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-from-web-server-parent.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-from-web-server-parent.asciidoc
@@ -30,7 +30,7 @@ This rule detects unusual processes spawned from a web server parent process by
 * Data Source: Elastic Defend
 * Resources: Investigation Guide
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
@@ -150,23 +150,59 @@ from logs-endpoint.events.process-*
     host.os.type == "linux" and
     event.type == "start" and
     event.action == "exec" and (
+      (
         process.parent.name in (
             "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
             "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
             "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
         ) or
-        process.parent.name like "php-*" or
-        process.parent.name like "python*" or
-        process.parent.name like "ruby*" or
-        process.parent.name like "perl*" or
         user.name in (
             "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
         ) or
         user.id in ("99", "33", "498", "48") or
         process.working_directory like "/var/www/*"
-    ) and not (
+      ) or
+      (
+        (
+          process.parent.name like "php-*" or
+          process.parent.name like "python*" or
+          process.parent.name like "ruby*" or
+          process.parent.name like "perl*"
+        ) and (
+          process.working_directory like "/var/www/*" or
+          process.working_directory like "/srv/www/*" or
+          process.working_directory like "/usr/share/nginx/*"
+        )
+      )
+    ) and (
+        process.name in (
+          "bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish", "socat", "openssl", "busybox",
+          "nc", "ncat", "netcat", "nc.openbsd", "nc.traditional", "nohup", "setsid", "mkfifo", "mknod",
+          "node", "socket"
+        ) or
+        process.name like "python*" or
+        process.name like "php*" or
+        process.name like "perl" or
+        process.name like "ruby*" or
+        process.name like "lua*" or
+        process.executable like "/tmp/*" or
+        process.executable like "/var/tmp/*" or
+        process.executable like "/dev/shm/*" or
+        process.executable like "/var/log/*" or
+        process.executable like "/sys/*" or
+        process.executable like "/media/*" or
+        process.executable like "/proc/*" or
+        process.executable like "/var/backups/*" or
+        process.executable like "/var/mail/*" or
+        process.executable like "/var/spool/*" or
+        process.executable like "/var/www/*" or
+        process.executable like "./*" or
+        process.name like ".*"
+    ) and    
+    not (
         process.working_directory like "/home/*" or
         process.working_directory == "/" or
+        process.working_directory like "/var/www/*.ch" or
         process.parent.executable like "/vscode/vscode-server/*"
     )
 | stats
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
index 165d467a8b..0c4d7c8dc2 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-exposed-to-kerberoasting.asciidoc
@@ -11,9 +11,9 @@ Detects when a user account has the servicePrincipalName attribute modified. Att
 * logs-system.security*
 * logs-windows.forwarded*
 
-*Severity*: high
+*Severity*: medium
 
-*Risk score*: 73
+*Risk score*: 47
 
 *Runs every*: 5m
 
@@ -41,7 +41,7 @@ Detects when a user account has the servicePrincipalName attribute modified. Att
 * Use Case: Active Directory Monitoring
 * Data Source: Windows Security Event Logs
 
-*Version*: 217
+*Version*: 218
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
index ebb95fc4c8..da14b03c67 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -3,7 +3,7 @@
 
 Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
 
-*Rule type*: eql
+*Rule type*: new_terms
 
 *Rule indices*: 
 
@@ -49,7 +49,7 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 * Data Source: Sysmon
 * Data Source: Crowdstrike
 
-*Version*: 419
+*Version*: 420
 
 *Rule authors*: 
 
@@ -120,18 +120,27 @@ This rule detects a web server process spawning script and command-line interfac
 
 [source, js]
 ----------------------------------
-process where host.os.type == "windows" and event.type == "start" and
-  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and
-  process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe", "wscript.exe") and
+host.os.type:windows and event.category:process and event.type:start and process.args : * and
+  process.parent.name:("w3wp.exe" or "httpd.exe" or "nginx.exe" or "php.exe" or "php-cgi.exe" or "tomcat.exe") and
+  (
+    process.name : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe") or
+    process.name.caseless : ("cmd.exe" or "cscript.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "wmic.exe" or "wscript.exe")
+  ) and
   not
   (
-    process.parent.name : ("php.exe", "httpd.exe") and process.name : "cmd.exe" and
     process.command_line : (
-      "cmd.exe /c mode CON",
-      "cmd.exe /s /c \"mode CON\"",
-      "cmd.exe /c \"mode\"",
-      "cmd.exe /s /c \"tput colors 2>&1\""
-    )
+      "cmd.exe /c mode CON" or
+      "cmd.exe /s /c \"mode CON\"" or
+      "cmd.exe /c \"mode\"" or
+      "cmd.exe /s /c \"tput colors 2>&1\"" or
+      "cmd.exe /s /c \"stty 2> NUL\"" or
+      "cmd.exe /s /c \"stty 2>&1\"" or
+      "cmd.exe /c \"stty 2>&1\"" or
+      "cmd.exe /s /c \"ipconfig /all 2>&1\"" or
+      "cmd.exe /s /c \"echo '%os%'\"" or
+      *.\\install\\awk.exe*
+    ) or
+    process.args : (\(git or (*artisan* and *queue\:work*) or *rmdir* or "mode CON" or ver or ls or mode or dir)
   )
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
index 9cae4d393c..3913d4bd13 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
@@ -49,7 +49,7 @@ Identifies modifications to the Windows Defender configuration settings using Po
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 316
+*Version*: 317
 
 *Rule authors*: 
 
@@ -127,7 +127,7 @@ Microsoft Windows Defender is an antivirus product built into Microsoft Windows.
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and
- (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")) and
+ (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")) and
   process.args : ("*Add-MpPreference*", "*Set-MpPreference*") and
   process.args : ("*-Exclusion*")
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
index ee466f98c8..09865200eb 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
@@ -50,7 +50,7 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 * Data Source: SentinelOne
 * Data Source: Crowdstrike
 
-*Version*: 314
+*Version*: 315
 
 *Rule authors*: 
 
@@ -114,7 +114,7 @@ This rule identifies patterns related to disabling the Windows firewall or its r
 process where host.os.type == "windows" and event.type == "start" and
   (
     process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
-    ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
+    ?process.pe.original_file_name in ("PowerShell.EXE", "pwsh.dll", "powershell_ise.EXE")
   ) and
   process.args : "*Set-NetFirewallProfile*" and
   process.args : "*-Enabled*" and process.args : "*False*" and
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
index fb57c31b86..b1bea2c1e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-service-installed-via-an-unusual-client.asciidoc
@@ -37,7 +37,7 @@ Identifies the creation of a Windows service by an unusual client process. Servi
 * Data Source: Windows Security Event Logs
 * Resources: Investigation Guide
 
-*Version*: 216
+*Version*: 217
 
 *Rule authors*: 
 
@@ -130,7 +130,13 @@ configuration where host.os.type == "windows" and
     "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
     "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
     "%SystemRoot%\\system32\\Drivers\\Crowdstrike\\*-CsInstallerService.exe",
-    "\"%windir%\\AdminArsenal\\PDQInventory-Scanner\\service-1\\PDQInventory-Scanner-1.exe\" "
+    "\"%windir%\\AdminArsenal\\PDQInventory-Scanner\\service-1\\PDQInventory-Scanner-1.exe\" ",
+    "\"%windir%\\AdminArsenal\\PDQDeployRunner\\service-1\\PDQDeployRunner-1.exe\" ",
+    "\"%windir%\\AdminArsenal\\PDQInventoryWakeCommand\\service-1\\PDQInventoryWakeCommand-1.exe\" ",
+    "\"%SystemRoot%\\nsnetpush.exe\"",
+    "\"C:\\WINDOWS\\ccmsetup\\ccmsetup.exe\" /runservice /ignoreskipupgrade /config:MobileClient.tcf",
+    "\"?:\\SMS\\bin\\x64\\srvboot.exe\"",
+    "%SystemRoot%\\pbpsdeploy.exe"
   )
 
 ----------------------------------
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index af8a49d263..a2711b8b7a 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -109,3 +109,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-18-11/prebuilt-rules-
 include::detections/prebuilt-rules/downloadable-packages/8-18-12/prebuilt-rules-8-18-12-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-18-13/prebuilt-rules-8-18-13-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-18-14/prebuilt-rules-8-18-14-appendix.asciidoc[]