From 00ff90840f2a5fbae496c763ef3333df2c48722e Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Sat, 14 Oct 2023 18:51:29 +0000
Subject: [PATCH 1/3] Update latest docs

---
 ...1-1-abnormally-large-dns-response.asciidoc | 105 +++++++
 ...ed-default-telnet-port-connection.asciidoc |  78 ++++++
 ...strike-command-and-control-beacon.asciidoc |  84 ++++++
 ...el-process-with-unusual-arguments.asciidoc |  92 +++++++
 ...s-and-directories-via-commandline.asciidoc | 112 ++++++++
 ...tion-of-hidden-shared-object-file.asciidoc | 107 ++++++++
 ...lt-strike-team-server-certificate.asciidoc |  85 ++++++
 ...a-ld-preload-environment-variable.asciidoc | 136 ++++++++++
 ...ting-domain-trusts-via-nltest-exe.asciidoc | 116 ++++++++
 ...tion-command-spawned-via-wmiprvse.asciidoc | 130 +++++++++
 ...eration-of-administrator-accounts.asciidoc | 135 +++++++++
 ...rivileged-local-groups-membership.asciidoc | 175 ++++++++++++
 ...nge-mailbox-export-via-powershell.asciidoc | 124 +++++++++
 ...n-or-modified-by-microsoft-office.asciidoc | 143 ++++++++++
 ...1-1-file-made-immutable-by-chattr.asciidoc | 109 ++++++++
 ...github-owner-role-granted-to-user.asciidoc |  62 +++++
 ...fbaked-command-and-control-beacon.asciidoc |  84 ++++++
 ...ocess-arguments-in-an-rdp-session.asciidoc |  58 ++++
 ...high-mean-of-rdp-session-duration.asciidoc |  58 ++++
 ...-variance-in-rdp-session-duration.asciidoc |  58 ++++
 ...windows-update-auto-update-client.asciidoc |  79 ++++++
 ...to-an-unsecure-elasticsearch-node.asciidoc |  71 +++++
 ...ipsec-nat-traversal-port-activity.asciidoc |  56 ++++
 ...shell-breakout-via-linux-binary-s.asciidoc | 225 +++++++++++++++
 ...-1-malicious-remote-file-creation.asciidoc |  63 +++++
 ...engine-started-an-unusual-process.asciidoc |  77 ++++++
 ...ngine-started-by-a-script-process.asciidoc |  73 +++++
 ...ngine-started-by-a-system-process.asciidoc |  82 ++++++
 ...-started-by-an-office-application.asciidoc | 140 ++++++++++
 ...ld-engine-using-an-alternate-name.asciidoc | 127 +++++++++
 ...e-8-11-1-new-github-app-installed.asciidoc |  58 ++++
 ...ule-8-11-1-new-github-owner-added.asciidoc |  62 +++++
 ...ript-or-desktop-file-modification.asciidoc | 121 +++++++++
 ...-dga-command-and-control-behavior.asciidoc |  82 ++++++
 ...-curl-cve-2023-38545-exploitation.asciidoc |  68 +++++
 ...ft-antimalware-service-executable.asciidoc |  88 ++++++
 ...ng-via-trusted-microsoft-programs.asciidoc |  81 ++++++
 ...1-potential-network-scan-detected.asciidoc |  74 +++++
 ...-potential-network-sweep-detected.asciidoc |  75 +++++
 ...openssh-backdoor-logging-activity.asciidoc | 143 ++++++++++
 ...hacktool-script-by-function-names.asciidoc | 256 ++++++++++++++++++
 ...lege-escalation-via-cve-2023-4911.asciidoc |  86 ++++++
 ...-protocol-tunneling-via-earthworm.asciidoc | 107 ++++++++
 ...-pspy-process-monitoring-detected.asciidoc |  93 +++++++
 ...erse-shell-via-background-process.asciidoc |  73 +++++
 ...x-ftp-brute-force-attack-detected.asciidoc | 108 ++++++++
 ...x-rdp-brute-force-attack-detected.asciidoc | 106 ++++++++
 ...l-syn-based-network-scan-detected.asciidoc |  74 +++++
 ...owershell-kerberos-ticket-request.asciidoc | 130 +++++++++
 ...ershell-mailbox-collection-script.asciidoc | 140 ++++++++++
 ...-11-1-powershell-psreflect-script.asciidoc | 157 +++++++++++
 ...-token-impersonation-capabilities.asciidoc | 122 +++++++++
 ...us-payload-encoded-and-compressed.asciidoc | 153 +++++++++++
 ...-clipboard-retrieval-capabilities.asciidoc | 144 ++++++++++
 ...esktop-protocol-from-the-internet.asciidoc | 108 ++++++++
 ...creation-on-a-sensitive-directory.asciidoc |  71 +++++
 ...file-downloaded-from-the-internet.asciidoc | 109 ++++++++
 ...-procedure-call-from-the-internet.asciidoc |  96 +++++++
 ...te-procedure-call-to-the-internet.asciidoc |  96 +++++++
 ...-sharing-activity-to-the-internet.asciidoc | 104 +++++++
 ...t-rule-8-11-1-smtp-on-port-26-tcp.asciidoc |  68 +++++
 ...connections-made-from-a-source-ip.asciidoc |  58 ++++
 ...nections-made-to-a-destination-ip.asciidoc |  58 ++++
 ...er-of-processes-in-an-rdp-session.asciidoc |  58 ++++
 ...-1-spike-in-remote-file-transfers.asciidoc |  58 ++++
 ...cious-powershell-engine-imageload.asciidoc | 119 ++++++++
 ...ion-via-renamed-psexec-executable.asciidoc | 106 ++++++++
 ...-rule-8-11-1-svchost-spawning-cmd.asciidoc | 121 +++++++++
 ...e-8-11-1-system-log-file-deletion.asciidoc | 124 +++++++++
 ...with-unusual-process-command-line.asciidoc |  60 ++++
 ...t-with-unusual-process-executable.asciidoc |  55 ++++
 ...1-1-unusual-remote-file-directory.asciidoc |  58 ++++
 ...1-1-unusual-remote-file-extension.asciidoc |  58 ++++
 ...e-8-11-1-unusual-remote-file-size.asciidoc |  58 ++++
 ...al-time-or-day-for-an-rdp-session.asciidoc |  58 ++++
 ...twork-computing-from-the-internet.asciidoc | 104 +++++++
 ...network-computing-to-the-internet.asciidoc |  96 +++++++
 .../prebuilt-rules-8-11-1-appendix.asciidoc   |  83 ++++++
 .../prebuilt-rules-8-11-1-summary.asciidoc    | 166 ++++++++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |  50 +---
 .../prebuilt-rules-reference.asciidoc         |  14 +
 .../prebuilt-rules/rule-desc-index.asciidoc   |   7 +
 ...-hidden-file-attribute-via-attrib.asciidoc |   2 +-
 .../adobe-hijack-persistence.asciidoc         |   2 +-
 ...-process-for-a-windows-population.asciidoc |   2 +-
 ...nomalous-windows-process-creation.asciidoc |   2 +-
 .../bypass-uac-via-event-viewer.asciidoc      |   2 +-
 ...dification-through-built-in-tools.asciidoc |   2 +-
 ...icy-modification-through-registry.asciidoc |   2 +-
 ...command-prompt-network-connection.asciidoc |   2 +-
 ...n-to-commonly-abused-web-services.asciidoc |   2 +-
 ...s-and-directories-via-commandline.asciidoc |  18 +-
 ...tion-of-hidden-shared-object-file.asciidoc |  18 +-
 ...a-ld-preload-environment-variable.asciidoc |  10 +-
 .../direct-outbound-smb-connection.asciidoc   |   2 +-
 ...rivileged-local-groups-membership.asciidoc |   2 +-
 ...om-unusual-directory-command-line.asciidoc |   2 +-
 .../file-made-immutable-by-chattr.asciidoc    |  18 +-
 ...value-accessed-in-secrets-manager.asciidoc |   2 +-
 .../first-time-seen-driver-loaded.asciidoc    |   2 +-
 ...eros-traffic-from-unusual-process.asciidoc |   2 +-
 .../linux-group-creation.asciidoc             |   4 +-
 ...shell-breakout-via-linux-binary-s.asciidoc |  10 +-
 .../linux-user-account-creation.asciidoc      |   4 +-
 ...ux-user-added-to-privileged-group.asciidoc |   4 +-
 .../lsass-memory-dump-creation.asciidoc       |   2 +-
 .../lsass-memory-dump-handle-access.asciidoc  |   2 +-
 ...ld-engine-using-an-alternate-name.asciidoc |   2 +-
 ...sbuild-making-network-connections.asciidoc |   2 +-
 ...failure-followed-by-logon-success.asciidoc |   2 +-
 ...lure-from-the-same-source-address.asciidoc |   2 +-
 .../network-connection-via-certutil.asciidoc  |   2 +-
 ...connection-via-compiled-html-file.asciidoc |   2 +-
 ...nnection-via-registration-utility.asciidoc |   2 +-
 ...work-connection-via-signed-binary.asciidoc |   2 +-
 .../new-systemd-timer-created.asciidoc        |   4 +-
 ...ript-or-desktop-file-modification.asciidoc |  18 +-
 ...pdate-orchestrator-service-hijack.asciidoc |   2 +-
 ...-scripts-in-the-startup-directory.asciidoc |   2 +-
 ...n-interface-bypass-via-powershell.asciidoc |   2 +-
 ...ess-via-trusted-developer-utility.asciidoc |   2 +-
 ...ty-to-an-unusual-destination-port.asciidoc |  58 ++++
 ...activity-to-an-unusual-ip-address.asciidoc |  58 ++++
 ...n-activity-to-an-unusual-iso-code.asciidoc |  58 ++++
 ...ion-activity-to-an-unusual-region.asciidoc |  58 ++++
 ...ential-evasion-via-filter-manager.asciidoc |   2 +-
 ...ux-backdoor-user-account-creation.asciidoc |   4 +-
 ...ication-of-accessibility-binaries.asciidoc |   2 +-
 ...openssh-backdoor-logging-activity.asciidoc |  18 +-
 ...rsistence-through-init-d-detected.asciidoc |   4 +-
 ...rough-motd-file-creation-detected.asciidoc |   4 +-
 ...ence-through-run-control-detected.asciidoc |   4 +-
 ...alation-via-installerfiletakeover.asciidoc |   2 +-
 ...-protocol-tunneling-via-earthworm.asciidoc |  18 +-
 ...ote-code-execution-via-web-server.asciidoc |   4 +-
 ...x-ftp-brute-force-attack-detected.asciidoc |   8 +-
 ...x-rdp-brute-force-attack-detected.asciidoc |   8 +-
 ...indows-error-manager-masquerading.asciidoc |   2 +-
 .../powershell-psreflect-script.asciidoc      |   2 +-
 ...us-payload-encoded-and-compressed.asciidoc |   2 +-
 ...tion-via-named-pipe-impersonation.asciidoc |   2 +-
 .../privileged-account-brute-force.asciidoc   |   2 +-
 ...s-activity-via-compiled-html-file.asciidoc |   2 +-
 ...-termination-followed-by-deletion.asciidoc |   2 +-
 ...istry-persistence-via-appinit-dll.asciidoc |   2 +-
 .../remote-execution-via-file-shares.asciidoc |   2 +-
 .../remote-file-copy-via-teamviewer.asciidoc  |   2 +-
 ...oad-via-desktopimgdownldr-utility.asciidoc |   2 +-
 ...remote-file-download-via-mpcmdrun.asciidoc |   2 +-
 ...mote-file-download-via-powershell.asciidoc |   2 +-
 ...e-download-via-script-interpreter.asciidoc |   2 +-
 ...remotely-started-services-via-rpc.asciidoc |   2 +-
 ...enamed-autoit-scripts-interpreter.asciidoc |   2 +-
 ...-executed-with-short-program-name.asciidoc |   2 +-
 ...ol-spawned-via-script-interpreter.asciidoc |   2 +-
 ...to-an-external-device-via-airdrop.asciidoc |  58 ++++
 ...-bytes-sent-to-an-external-device.asciidoc |  58 ++++
 ...-persistence-via-unsigned-process.asciidoc |   2 +-
 ...-or-run-key-registry-modification.asciidoc |   2 +-
 ...rsistence-by-a-suspicious-process.asciidoc |   2 +-
 ...urst-command-and-control-activity.asciidoc |   2 +-
 ...us-antimalware-scan-interface-dll.asciidoc |   2 +-
 .../suspicious-certutil-commands.asciidoc     |   2 +-
 ...ous-net-reflection-via-powershell.asciidoc |   2 +-
 ...able-encoded-in-powershell-script.asciidoc |   2 +-
 ...us-print-spooler-spl-file-created.asciidoc |   2 +-
 ...ess-access-via-direct-system-call.asciidoc |   2 +-
 ...rocess-spawned-from-motd-detected.asciidoc |   4 +-
 ...rvice-was-installed-in-the-system.asciidoc |   2 +-
 ...startup-shell-folder-modification.asciidoc |   2 +-
 .../suspicious-zoom-child-process.asciidoc    |   2 +-
 .../svchost-spawning-cmd.asciidoc             |   2 +-
 .../system-log-file-deletion.asciidoc         |  18 +-
 .../system-shells-via-services.asciidoc       |   2 +-
 ...threat-intel-hash-indicator-match.asciidoc |   6 +-
 ...-intel-ip-address-indicator-match.asciidoc |   6 +-
 .../threat-intel-url-indicator-match.asciidoc |   6 +-
 ...-windows-registry-indicator-match.asciidoc |   6 +-
 ...ia-windows-directory-masquerading.asciidoc |   2 +-
 ...a-windows-firewall-snap-in-hijack.asciidoc |   2 +-
 .../untrusted-driver-loaded.asciidoc          |   2 +-
 ...tion-by-a-system-critical-process.asciidoc |   2 +-
 ...le-creation-alternate-data-stream.asciidoc |   2 +-
 ...vity-from-a-windows-system-binary.asciidoc |   2 +-
 ...unusual-parent-child-relationship.asciidoc |   2 +-
 ...nusual-process-for-a-windows-host.asciidoc |   2 +-
 ...riting-data-to-an-external-device.asciidoc |  58 ++++
 ...ntial-dumping-using-netsh-command.asciidoc |   2 +-
 docs/index.asciidoc                           |   2 +
 189 files changed, 8412 insertions(+), 236 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-abnormally-large-dns-response.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-accepted-default-telnet-port-connection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-administrator-accounts.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-github-owner-role-granted-to-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-malicious-remote-file-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-app-installed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-owner-added.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-scan-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-sweep-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-kerberos-ticket-request.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-mailbox-collection-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smtp-on-port-26-tcp.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-remote-file-transfers.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-extension.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-size.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-abnormally-large-dns-response.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-abnormally-large-dns-response.asciidoc
new file mode 100644
index 0000000000..50b9c1155e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-abnormally-large-dns-response.asciidoc
@@ -0,0 +1,105 @@
+[[prebuilt-rule-8-11-1-abnormally-large-dns-response]]
+=== Abnormally Large DNS Response
+
+Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: None ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://github.com/maxpl0it/CVE-2020-1350-DoS
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Use Case: Vulnerability
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Abnormally Large DNS Response
+
+Detection alerts from this rule indicate possible anomalous activity around large byte DNS responses from a Windows DNS server. This detection rule was created based on activity represented in exploitation of vulnerability (CVE-2020-1350) also known as [SigRed](https://www.elastic.co/blog/detection-rules-for-sigred-vulnerability) during July 2020.
+
+#### Possible investigation steps
+
+- This specific rule is sourced from network log activity such as DNS or network level data. It's important to validate the source of the incoming traffic and determine if this activity has been observed previously within an environment.
+- Activity can be further investigated and validated by reviewing any associated Intrusion Detection Signatures (IDS) alerts.
+- Further examination can include a review of the `dns.question_type` network fieldset with a protocol analyzer, such as Zeek, Packetbeat, or Suricata, for `SIG` or `RRSIG` data.
+- Validate the patch level and OS of the targeted DNS server to validate the observed activity was not large-scale internet vulnerability scanning.
+- Validate that the source of the network activity was not from an authorized vulnerability scan or compromise assessment.
+
+#### False positive analysis
+
+- Based on this rule, which looks for a threshold of 60k bytes, it is possible for activity to be generated under 65k bytes and related to legitimate behavior. In packet capture files received by the [SANS Internet Storm Center](https://isc.sans.edu/forums/diary/PATCH+NOW+SIGRed+CVE20201350+Microsoft+DNS+Server+Vulnerability/26356/), byte responses were all observed as greater than 65k bytes.
+- This activity can be triggered by compliance/vulnerability scanning or compromise assessment; it's important to determine the source of the activity and potentially allowlist the source host.
+
+### Related rules
+
+- Unusual Child Process of dns.exe - 8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45
+- Unusual File Modification by dns.exe - c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Ensure that you have deployed the latest Microsoft [Security Update](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350) (Monthly Rollup or Security Only) and restarted the patched machines. If unable to patch immediately, Microsoft [released](https://support.microsoft.com/en-us/help/4569509/windows-dns-server-remote-code-execution-vulnerability) a registry-based workaround that doesn’t require a restart. This can be used as a temporary solution before the patch is applied.
+- Maintain backups of your critical systems to aid in quick recovery.
+- Perform routine vulnerability scans of your systems, monitor [CISA advisories](https://us-cert.cisa.gov/ncas/current-activity) and patch identified vulnerabilities.
+- If you observe a true positive, implement a remediation plan and monitor host-based artifacts for additional post-exploitation behavior.
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.dns or (event.category: (network or network_traffic) and destination.port: 53)) and
+  (event.dataset:zeek.dns or type:dns or event.type:connection) and network.bytes > 60000
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-accepted-default-telnet-port-connection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-accepted-default-telnet-port-connection.asciidoc
new file mode 100644
index 0000000000..f1d5fb1d94
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-accepted-default-telnet-port-connection.asciidoc
@@ -0,0 +1,78 @@
+[[prebuilt-rule-8-11-1-accepted-default-telnet-port-connection]]
+=== Accepted Default Telnet Port Connection
+
+This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Lateral Movement
+* Tactic: Initial Access
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset:network_traffic.flow or event.category:(network or network_traffic))
+    and event.type:connection and not event.action:(
+        flow_dropped or denied or deny or
+        flow_terminated or timeout or Reject or network_flow)
+    and destination.port:23
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon.asciidoc
new file mode 100644
index 0000000000..26af192794
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon.asciidoc
@@ -0,0 +1,84 @@
+[[prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon]]
+=== Cobalt Strike Command and Control Beacon
+
+Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.morphisec.com/fin7-attacks-restaurant-industry
+* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
+* https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Threat intel
+
+This activity has been observed in FIN7 campaigns.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+((event.category: (network or network_traffic) and type: (tls or http))
+    or event.dataset: (network_traffic.tls or network_traffic.http)
+) and destination.domain:/[a-z]{3}.stage.[0-9]{8}\..*/
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments.asciidoc
new file mode 100644
index 0000000000..f7adfe3076
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments]]
+=== Control Panel Process with Unusual Arguments
+
+Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.joesandbox.com/analysis/476188/1/html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
+ process.command_line :
+          ("*.jpg*",
+           "*.png*",
+           "*.gif*",
+           "*.bmp*",
+           "*.jpeg*",
+           "*.TIFF*",
+           "*.inf*",
+           "*.cpl:*/*",
+           "*../../..*",
+           "*/AppData/Local/*",
+           "*:\\Users\\Public\\*",
+           "*\\AppData\\Local\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Control Panel
+** ID: T1218.002
+** Reference URL: https://attack.mitre.org/techniques/T1218/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
new file mode 100644
index 0000000000..9e563c285e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline]]
+=== Creation of Hidden Files and Directories via CommandLine
+
+Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+process.working_directory in ("/tmp", "/var/tmp", "/dev/shm") and
+process.args regex~ """\.[a-z0-9_\-][a-z0-9_\-\.]{1,254}""" and
+not process.name in ("ls", "find", "grep", "git")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
new file mode 100644
index 0000000000..3895772607
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
@@ -0,0 +1,107 @@
+[[prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file]]
+=== Creation of Hidden Shared Object File
+
+Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "creation" and file.extension == "so" and file.name : ".*.so"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate.asciidoc
new file mode 100644
index 0000000000..074c6bbe92
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate.asciidoc
@@ -0,0 +1,85 @@
+[[prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate]]
+=== Default Cobalt Strike Team Server Certificate
+
+This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/software/S0154/
+* https://www.cobaltstrike.com/help-setup-collaboration
+* https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-tls.html
+* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-suricata.html
+* https://www.elastic.co/guide/en/beats/filebeat/7.9/filebeat-module-zeek.html
+* https://www.elastic.co/security-labs/collecting-cobalt-strike-beacons-with-the-elastic-stack
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Threat: Cobalt Strike
+* Use Case: Threat Detection
+* Domain: Endpoint
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Threat intel
+
+While Cobalt Strike is intended to be used for penetration tests and IR training, it is frequently used by actual threat actors (TA) such as APT19, APT29, APT32, APT41, FIN6, DarkHydrus, CopyKittens, Cobalt Group, Leviathan, and many other unnamed criminal TAs. This rule uses high-confidence atomic indicators, so alerts should be investigated rapidly.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.tls or event.category: (network or network_traffic))
+  and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83
+  or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C
+  or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
new file mode 100644
index 0000000000..aeb072b763
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable]]
+=== Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable
+
+This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.getambassador.io/resources/code-injection-on-linux-and-macos
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+This rule was deprecated due to the large amount of false positives and the lack of true positives generated by the rule.
+
+
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
+ #### To set up environment variable capture for an Elastic Agent policy:
+- Go to Security → Manage → Policies.
+- Select an Elastic Agent policy.
+- Click Show advanced settings.
+- Scroll down or search for linux.advanced.capture_env_vars.
+- Enter the names of env vars you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "LD_PRELOAD,LD_LIBRARY_PATH".
+- Click Save.
+After saving the integration change, the Elastic Agents running this policy will be updated and
+the rule will function properly.
+For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action == "exec" and process.env_vars : ("LD_PRELOAD=?*", "LD_LIBRARY_PATH=?*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Dynamic Linker Hijacking
+** ID: T1574.006
+** Reference URL: https://attack.mitre.org/techniques/T1574/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe.asciidoc
new file mode 100644
index 0000000000..bf0cbe3d27
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe]]
+=== Enumerating Domain Trusts via NLTEST.EXE
+
+Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
+* https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Enumerating Domain Trusts via NLTEST.EXE
+
+Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
+
+This rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+### Related rules
+
+- Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    process.name : "nltest.exe" and process.args : (
+        "/DCLIST:*", "/DCNAME:*", "/DSGET*",
+        "/LSAQUERYFTI:*", "/PARENTDOMAIN",
+        "/DOMAIN_TRUSTS", "/BDC_QUERY:*"
+        ) and 
+not process.parent.name : "PDQInventoryScanner.exe" and 
+not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse.asciidoc
new file mode 100644
index 0000000000..84b9f100dd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse]]
+=== Enumeration Command Spawned via WMIPrvSE
+
+Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name:
+  (
+    "arp.exe",
+    "dsquery.exe",
+    "dsget.exe",
+    "gpresult.exe",
+    "hostname.exe",
+    "ipconfig.exe",
+    "nbtstat.exe",
+    "net.exe",
+    "net1.exe",
+    "netsh.exe",
+    "netstat.exe",
+    "nltest.exe",
+    "ping.exe",
+    "qprocess.exe",
+    "quser.exe",
+    "qwinsta.exe",
+    "reg.exe",
+    "sc.exe",
+    "systeminfo.exe",
+    "tasklist.exe",
+    "tracert.exe",
+    "whoami.exe"
+  ) and
+  process.parent.name:"wmiprvse.exe" and 
+  not (
+    process.name : "sc.exe" and process.args : "RemoteRegistry" and process.args : "start=" and 
+    process.args : ("demand", "disabled")
+  ) and
+  not process.args : "tenable_mw_scan"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
+* Sub-technique:
+** Name: Internet Connection Discovery
+** ID: T1016.001
+** Reference URL: https://attack.mitre.org/techniques/T1016/001/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-administrator-accounts.asciidoc
new file mode 100644
index 0000000000..c6c677751a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-administrator-accounts.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-11-1-enumeration-of-administrator-accounts]]
+=== Enumeration of Administrator Accounts
+
+Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Enumeration of Administrator Accounts
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+### Related rules
+
+- AdFind Command Activity - eda499b8-a073-4e35-9733-22ec71f57f3a
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (((process.name : "net.exe" or process.pe.original_file_name == "net.exe") or
+    ((process.name : "net1.exe" or process.pe.original_file_name == "net1.exe") and
+        not process.parent.name : "net.exe")) and
+   process.args : ("group", "user", "localgroup") and
+   process.args : ("*admin*", "Domain Admins", "Remote Desktop Users", "Enterprise Admins", "Organization Management") and
+   not process.args : "/add")
+
+   or
+
+  ((process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
+     process.args : ("group", "useraccount"))
+) and not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
new file mode 100644
index 0000000000..e2ceea8cc7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
@@ -0,0 +1,175 @@
+[[prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership]]
+=== Enumeration of Privileged Local Groups Membership
+
+Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Enumeration of Privileged Local Groups Membership
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Identify the process, host and user involved on the event.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+The 'Audit Security Group Management' audit policy must be configured (Success).
+Steps to implement the logging policy with with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Account Management >
+Audit Security Group Management (Success)
+```
+
+Microsoft introduced the [event used](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799) in this detection rule on Windows 10 and Windows Server 2016 or later operating systems.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:iam and event.action:user-member-enumerated and 
+  (
+    group.name:(*Admin* or "RemoteDesktopUsers") or
+    winlog.event_data.TargetSid:("S-1-5-32-544" or "S-1-5-32-555")
+  ) and 
+  not (winlog.event_data.SubjectUserName: (*$ or "LOCAL SERVICE" or "NETWORK SERVICE") or 
+  winlog.event_data.CallerProcessName:("-" or 
+                                       *\:\\\\Windows\\\\System32\\\\VSSVC.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\SearchIndexer.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\oobe\\\\msoobe.exe or
+                                       *\:\\\\Windows\\\\System32\\\\net1.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\svchost.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\Netplwiz.exe or 
+                                       *\:\\\\Windows\\\\System32\\\\msiexec.exe or
+                                       *\:\\\\Windows\\\\System32\\\\CloudExperienceHostBroker.exe or
+                                       *\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe or
+                                       *\:\\\\Windows\\\\System32\\\\SrTasks.exe or
+                                       *\:\\\\Windows\\\\System32\\\\diskshadow.exe or
+                                       *\:\\\\Windows\\\\System32\\\\dfsrs.exe or
+                                       *\:\\\\Windows\\\\System32\\\\vssadmin.exe or
+                                       *\:\\\\Windows\\\\System32\\\\dllhost.exe or
+                                       *\:\\\\Windows\\\\System32\\\\mmc.exe or
+                                       *\:\\\\Windows\\\\System32\\\\SettingSyncHost.exe or
+                                       *\:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe or
+                                       *\:\\\\Windows\\\\System32\\\\wsmprovhost.exe or
+                                       *\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\x3jobt3?.exe or
+                                       *\:\\\\Windows\\\\System32\\\\mstsc.exe or
+                                       *\:\\\\Windows\\\\System32\\\\esentutl.exe or
+                                       *\:\\\\Windows\\\\System32\\\\RecoveryDrive.exe or
+                                       *\:\\\\Windows\\\\System32\\\\SystemPropertiesComputerName.exe or
+                                       *\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe or
+                                       *\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe or
+                                       *\:\\\\Windows\\\\Temp\\\\rubrik_vmware???\\\\snaptool.exe or
+                                       *\:\\\\Windows\\\\VeeamVssSupport\\\\VeeamGuestHelper.exe or
+                                       ?\:\\\\WindowsAzure\\\\*WaAppAgent.exe or
+                                       ?\:\\\\Program?Files?\(x86\)\\\\*.exe or
+                                       ?\:\\\\Program?Files\\\\*.exe or
+                                       ?\:\\\\$WINDOWS.~BT\\\\Sources\\\\*.exe
+                                      )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell.asciidoc
new file mode 100644
index 0000000000..0ec8607707
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell]]
+=== Exchange Mailbox Export via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Exchange Mailbox Export via PowerShell
+
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the export operation:
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+  - Contact the account owner and confirm whether they are aware of this activity.
+  - Check if this operation was approved and performed according to the organization's change management policy.
+  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
+- If the operation was completed successfully:
+  - Check if the file is on the path specified in the command.
+  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : "New-MailboxExportRequest" and
+  not (
+    file.path : (
+      ?\:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Exchange\\\\RemotePowerShell\\\\*
+    ) and file.name:(*.psd1 or *.psm1)
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc
new file mode 100644
index 0000000000..93c64ffbd1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office]]
+=== Execution of File Written or Modified by Microsoft Office
+
+Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 60m
+
+*Searches indices from*: now-120m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Execution of File Written or Modified by Microsoft Office
+
+Microsoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+
+This rule searches for executable files written by MS Office applications executed in sequence. This is most likely the result of the execution of malicious documents or exploitation for initial access or privilege escalation. This rule can also detect suspicious processes masquerading as the MS Office applications.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=2h
+  [file where host.os.type == "windows" and event.type != "deletion" and file.extension : "exe" and
+     (process.name : "WINWORD.EXE" or
+      process.name : "EXCEL.EXE" or
+      process.name : "OUTLOOK.EXE" or
+      process.name : "POWERPNT.EXE" or
+      process.name : "eqnedt32.exe" or
+      process.name : "fltldr.exe" or
+      process.name : "MSPUB.EXE" or
+      process.name : "MSACCESS.EXE")
+  ] by host.id, file.path
+  [process where host.os.type == "windows" and event.type == "start" and 
+   not (process.name : "NewOutlookInstaller.exe" and process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+  ] by host.id, process.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
new file mode 100644
index 0000000000..2555ae3731
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
@@ -0,0 +1,109 @@
+[[prebuilt-rule-8-11-1-file-made-immutable-by-chattr]]
+=== File made Immutable by Chattr
+
+Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and user.name == "root" and
+  process.executable : "/usr/bin/chattr" and process.args : ("-*i*", "+*i*") and
+  not process.parent.executable: ("/lib/systemd/systemd", "/usr/local/uems_agent/bin/*", "/usr/lib/systemd/systemd")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
+* Sub-technique:
+** Name: Linux and Mac File and Directory Permissions Modification
+** ID: T1222.002
+** Reference URL: https://attack.mitre.org/techniques/T1222/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-github-owner-role-granted-to-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-github-owner-role-granted-to-user.asciidoc
new file mode 100644
index 0000000000..c22fa62e22
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-github-owner-role-granted-to-user.asciidoc
@@ -0,0 +1,62 @@
+[[prebuilt-rule-8-11-1-github-owner-role-granted-to-user]]
+=== GitHub Owner Role Granted To User
+
+This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-github.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Github
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+iam where event.dataset == "github.audit" and event.action == "org.update_member" and github.permission == "admin"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Additional Cloud Roles
+** ID: T1098.003
+** Reference URL: https://attack.mitre.org/techniques/T1098/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon.asciidoc
new file mode 100644
index 0000000000..df0d6a4b84
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon.asciidoc
@@ -0,0 +1,84 @@
+[[prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon]]
+=== Halfbaked Command and Control Beacon
+
+Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
+* https://attack.mitre.org/software/S0151/
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Threat intel
+
+This activity has been observed in FIN7 campaigns.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: (network_traffic.tls or network_traffic.http) or
+  (event.category: (network or network_traffic) and network.protocol: http)) and
+  network.transport:tcp and url.full:/http:\/\/[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}\/cd/ and
+  destination.port:(53 or 80 or 8080 or 443)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session.asciidoc
new file mode 100644
index 0000000000..c7420afdcb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session]]
+=== High Mean of Process Arguments in an RDP Session
+
+A machine learning job has detected unusually high number of process arguments in an RDP session. Executing sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, redirection and piping, which in turn increases the number of arguments in a command.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration.asciidoc
new file mode 100644
index 0000000000..9077ff1c42
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration]]
+=== High Mean of RDP Session Duration
+
+A machine learning job has detected unusually high mean of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration.asciidoc
new file mode 100644
index 0000000000..3bda481d4c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration]]
+=== High Variance in RDP Session Duration
+
+A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client.asciidoc
new file mode 100644
index 0000000000..4dfd8b7184
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client.asciidoc
@@ -0,0 +1,79 @@
+[[prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client]]
+=== ImageLoad via Windows Update Auto Update Client
+
+Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://dtm.uk/wuauclt/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
+   /* necessary windows update client args to load a dll */
+   process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
+   /* common paths writeable by a standard user where the target DLL can be placed */
+   process.args : ("C:\\Users\\*.dll", "C:\\ProgramData\\*.dll", "C:\\Windows\\Temp\\*.dll", "C:\\Windows\\Tasks\\*.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
new file mode 100644
index 0000000000..e6da823126
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc
@@ -0,0 +1,71 @@
+[[prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node]]
+=== Inbound Connection to an Unsecure Elasticsearch Node
+
+Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-security.html
+* https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-http-options.html#_send_all_headers
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Domain: Endpoint
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.http or (event.category: network_traffic and network.protocol: http)) and
+    status:OK and destination.port:9200 and network.direction:inbound and NOT http.response.headers.content-type:"image/x-icon" and not
+    _exists_:http.request.headers.authorization
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity.asciidoc
new file mode 100644
index 0000000000..34bd3098c3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity.asciidoc
@@ -0,0 +1,56 @@
+[[prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity]]
+=== IPSEC NAT Traversal Port Activity
+
+This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and network.transport:udp and destination.port:4500
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
new file mode 100644
index 0000000000..c78d7358e4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -0,0 +1,225 @@
+[[prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s]]
+=== Linux Restricted Shell Breakout via Linux Binary(s)
+
+Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://gtfobins.github.io/gtfobins/apt/
+* https://gtfobins.github.io/gtfobins/apt-get/
+* https://gtfobins.github.io/gtfobins/nawk/
+* https://gtfobins.github.io/gtfobins/mawk/
+* https://gtfobins.github.io/gtfobins/awk/
+* https://gtfobins.github.io/gtfobins/gawk/
+* https://gtfobins.github.io/gtfobins/busybox/
+* https://gtfobins.github.io/gtfobins/c89/
+* https://gtfobins.github.io/gtfobins/c99/
+* https://gtfobins.github.io/gtfobins/cpulimit/
+* https://gtfobins.github.io/gtfobins/crash/
+* https://gtfobins.github.io/gtfobins/env/
+* https://gtfobins.github.io/gtfobins/expect/
+* https://gtfobins.github.io/gtfobins/find/
+* https://gtfobins.github.io/gtfobins/flock/
+* https://gtfobins.github.io/gtfobins/gcc/
+* https://gtfobins.github.io/gtfobins/mysql/
+* https://gtfobins.github.io/gtfobins/nice/
+* https://gtfobins.github.io/gtfobins/ssh/
+* https://gtfobins.github.io/gtfobins/vi/
+* https://gtfobins.github.io/gtfobins/vim/
+* https://gtfobins.github.io/gtfobins/capsh/
+* https://gtfobins.github.io/gtfobins/byebug/
+* https://gtfobins.github.io/gtfobins/git/
+* https://gtfobins.github.io/gtfobins/ftp/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Shell Evasion via Linux Utilities
+Detection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or
+environments by spawning an interactive system shell.
+Here are some possible avenues of investigation:
+- Examine the entry point to the host and user in action via the Analyse View.
+  - Identify the session entry leader and session user
+- Examine the contents of session leading to the abuse via the Session View.
+  - Examine the command execution pattern in the session, which may lead to suspricous activities
+- Examine the execution of commands in the spawned shell.
+  - Identify imment threat to the system from the executed commands
+  - Take necessary incident response actions to contain any malicious behviour caused via this execution.
+
+### Related rules
+
+- A malicious spawned shell can execute any of the possible MITTRE ATT&CK vectors mainly to impair defences.
+- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment
+
+### Response and remediation
+
+Initiate the incident response process based on the outcome of the triage.
+
+- If the triage releaved suspicious netwrok activity from the malicious spawned shell,
+  - Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware execution via the maliciously spawned shell,
+  - Search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- If the triage revelaed defence evasion for imparing defenses
+  - Isolate the involved host to prevent further post-compromise behavior.
+  - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.
+  - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.
+- If the triage revelaed addition of persistence mechanism exploit like auto start scripts
+  - Isolate further login to the systems that can initae auto start scripts.
+  - Identify the auto start scripts and disable and remove the same from the systems
+- If the triage revealed data crawling or data export via remote copy
+  - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling
+  - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.
+  - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
+#### To confirm that Session View data is enabled:
+- Go to Manage → Policies, and edit one or more of your Elastic Defend integration policies.
+- Select the Policy settings tab, then scroll down to the Linux event collection section near the bottom.
+- Check the box for Process events, and turn on the Include session data toggle.
+- If you want to include file and network alerts in Session View, check the boxes for Network and File events.
+- If you want to enable terminal output capture, turn on the Capture terminal output toggle.
+For more information about the additional fields collected when this setting is enabled and
+the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+(
+  /* launching shell from capsh */
+  (process.name == "capsh" and process.args == "--") or
+  
+  /* launching shells from unusual parents or parent+arg combos */
+  (process.name : "*sh" and (
+    (process.parent.name : "*awk" and process.parent.args : "BEGIN {system(*)}") or
+    (process.parent.name == "git" and process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or 
+     process.args : ("*PAGER*", "!*sh", "exec *sh") and not process.name == "ssh" ) or
+    (process.parent.name : ("byebug", "ftp", "strace", "zip", "tar") and 
+    (
+      process.parent.args : "BEGIN {system(*)}" or
+      (process.parent.args : ("*PAGER*", "!*sh", "exec *sh") or process.args : ("*PAGER*", "!*sh", "exec *sh")) or
+      (
+        (process.parent.args : "exec=*sh" or (process.parent.args : "-I" and process.parent.args : "*sh")) or
+        (process.args : "exec=*sh" or (process.args : "-I" and process.args : "*sh"))
+        )
+      )
+    ) or
+    
+    /* shells specified in parent args */
+    /* nice rule is broken in 8.2 */
+    (process.parent.args : "*sh" and
+      (
+        (process.parent.name == "nice") or
+        (process.parent.name == "cpulimit" and process.parent.args == "-f") or
+        (process.parent.name == "find" and process.parent.args == "." and process.parent.args == "-exec" and 
+         process.parent.args == ";" and process.parent.args : "/bin/*sh") or
+        (process.parent.name == "flock" and process.parent.args == "-u" and process.parent.args == "/")
+      )
+    )
+  )) or
+
+  /* shells specified in args */
+  (process.args : "*sh" and (
+    (process.parent.name == "crash" and process.parent.args == "-h") or
+    (process.name == "sensible-pager" and process.parent.name in ("apt", "apt-get") and process.parent.args == "changelog")
+    /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */
+    
+  )) or
+  (process.name == "busybox" and event.action == "exec" and process.args_count == 2 and process.args : "*sh" and not 
+   process.executable : "/var/lib/docker/overlay2/*/merged/bin/busybox" and not (process.parent.args == "init" and
+   process.parent.args == "runc") and not process.parent.args in ("ls-remote", "push", "fetch") and not process.parent.name == "mkinitramfs") or
+  (process.name == "env" and process.args_count == 2 and process.args : "*sh") or
+  (process.parent.name in ("vi", "vim") and process.parent.args == "-c" and process.parent.args : ":!*sh") or
+  (process.parent.name in ("c89", "c99", "gcc") and process.parent.args : "*sh,-s" and process.parent.args == "-wrapper") or
+  (process.parent.name == "expect" and process.parent.args == "-c" and process.parent.args : "spawn *sh;interact") or
+  (process.parent.name == "mysql" and process.parent.args == "-e" and process.parent.args : "\\!*sh") or
+  (process.parent.name == "ssh" and process.parent.args == "-o" and process.parent.args : "ProxyCommand=;*sh 0<&2 1>&2")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-malicious-remote-file-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-malicious-remote-file-creation.asciidoc
new file mode 100644
index 0000000000..70bbe849e9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-malicious-remote-file-creation.asciidoc
@@ -0,0 +1,63 @@
+[[prebuilt-rule-8-11-1-malicious-remote-file-creation]]
+=== Malicious Remote File Creation
+
+Malicious remote file creation, which can be an indicator of lateral movement activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: critical
+
+*Risk score*: 99
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security
+
+*Tags*: 
+
+* Domain: Endpoint
+* Use Case: Lateral Movement Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.name
+[file where event.action == "creation" and process.name : ("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")]
+[file where event.category == "malware" or event.category == "intrusion_detection"
+and process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process.asciidoc
new file mode 100644
index 0000000000..444facc686
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process.asciidoc
@@ -0,0 +1,77 @@
+[[prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process]]
+=== Microsoft Build Engine Started an Unusual Process
+
+An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 206
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and process.parent.name:"MSBuild.exe" and
+process.name.caseless:("csc.exe" or "iexplore.exe" or "powershell.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Sub-technique:
+** Name: Compile After Delivery
+** ID: T1027.004
+** Reference URL: https://attack.mitre.org/techniques/T1027/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process.asciidoc
new file mode 100644
index 0000000000..59dd94c0f9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process]]
+=== Microsoft Build Engine Started by a Script Process
+
+An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 205
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and (
+  process.name.caseless:"msbuild.exe" or process.pe.original_file_name:"MSBuild.exe") and 
+  process.parent.name:("cmd.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "cscript.exe" or
+    "wscript.exe" or "mshta.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process.asciidoc
new file mode 100644
index 0000000000..5e36b0086d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process]]
+=== Microsoft Build Engine Started by a System Process
+
+An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("explorer.exe", "wmiprvse.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application.asciidoc
new file mode 100644
index 0000000000..2ec4fd7404
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application.asciidoc
@@ -0,0 +1,140 @@
+[[prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application]]
+=== Microsoft Build Engine Started by an Office Application
+
+An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Microsoft Build Engine Started by an Office Application
+
+Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the execution of malicious documents.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("eqnedt32.exe",
+                         "excel.exe",
+                         "fltldr.exe",
+                         "msaccess.exe",
+                         "mspub.exe",
+                         "outlook.exe",
+                         "powerpnt.exe",
+                         "winword.exe" )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
new file mode 100644
index 0000000000..1a3f5a90d3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -0,0 +1,127 @@
+[[prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name]]
+=== Microsoft Build Engine Using an Alternate Name
+
+An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Microsoft Build Engine Using an Alternate Name
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name == "MSBuild.exe" and
+  not process.name : "MSBuild.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-app-installed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-app-installed.asciidoc
new file mode 100644
index 0000000000..69872f4a1a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-app-installed.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-new-github-app-installed]]
+=== New GitHub App Installed
+
+This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-github.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Github
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+configuration where event.dataset == "github.audit" and event.action == "integration_installation.create"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Software Deployment Tools
+** ID: T1072
+** Reference URL: https://attack.mitre.org/techniques/T1072/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-owner-added.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-owner-added.asciidoc
new file mode 100644
index 0000000000..9ce2b5ef3a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-new-github-owner-added.asciidoc
@@ -0,0 +1,62 @@
+[[prebuilt-rule-8-11-1-new-github-owner-added]]
+=== New GitHub Owner Added
+
+Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-github.audit-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Cloud
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Github
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+iam where event.dataset == "github.audit" and event.action == "org.add_member" and github.permission == "admin"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Cloud Account
+** ID: T1136.003
+** Reference URL: https://attack.mitre.org/techniques/T1136/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
new file mode 100644
index 0000000000..0fbd603ed0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification]]
+=== Persistence via KDE AutoStart Script or Desktop File Modification
+
+Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://userbase.kde.org/System_Settings/Autostart
+* https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/
+* https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type != "deletion" and
+  file.extension in ("sh", "desktop") and
+  file.path :
+    (
+      "/home/*/.config/autostart/*", "/root/.config/autostart/*",
+      "/home/*/.kde/Autostart/*", "/root/.kde/Autostart/*",
+      "/home/*/.kde4/Autostart/*", "/root/.kde4/Autostart/*",
+      "/home/*/.kde/share/autostart/*", "/root/.kde/share/autostart/*",
+      "/home/*/.kde4/share/autostart/*", "/root/.kde4/share/autostart/*",
+      "/home/*/.local/share/autostart/*", "/root/.local/share/autostart/*",
+      "/home/*/.config/autostart-scripts/*", "/root/.config/autostart-scripts/*",
+      "/etc/xdg/autostart/*", "/usr/share/autostart/*"
+    ) and
+    not process.name in ("yum", "dpkg", "install", "dnf", "teams", "yum-cron", "dnf-automatic", "docker", "dockerd", 
+    "rpm")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior.asciidoc
new file mode 100644
index 0000000000..8cc7bca396
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior]]
+=== Possible FIN7 DGA Command and Control Behavior
+
+This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+In the event this rule identifies benign domains in your environment, the `destination.domain` field in the rule can be modified to include those domains. Example: `...AND NOT destination.domain:(zoom.us OR benign.domain1 OR benign.domain2)`.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: (network_traffic.tls or network_traffic.http) or
+    (event.category: (network or network_traffic) and type: (tls or http) and network.transport: tcp)) and
+destination.domain:/[a-zA-Z]{4,5}\.(pw|us|club|info|site|top)/ AND NOT destination.domain:zoom.us
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation.asciidoc
new file mode 100644
index 0000000000..925f25424b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation.asciidoc
@@ -0,0 +1,68 @@
+[[prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation]]
+=== Potential curl CVE-2023-38545 Exploitation
+
+Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction with an unusual command line length. A flaw in curl version <= 8.3 makes curl vulnerable to a heap based buffer overflow during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://curl.se/docs/CVE-2023-38545.html
+* https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/
+* https://twitter.com/_JohnHammond/status/1711986412554531015
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Use Case: Vulnerability
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and process.name == "curl" 
+and (
+  process.args : ("--socks5-hostname", "--proxy", "--preproxy", "socks5*") or 
+  process.env_vars: ("http_proxy=socks5h://*", "HTTPS_PROXY=socks5h://*", "ALL_PROXY=socks5h://*")
+) and length(process.command_line) > 255
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
new file mode 100644
index 0000000000..edf8e2ddac
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
@@ -0,0 +1,88 @@
+[[prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable]]
+=== Potential DLL Side-Loading via Microsoft Antimalware Service Executable
+
+Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+* Dennis Perto
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or
+  (process.name : "MsMpEng.exe" and not
+        process.executable : ("?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Windows Defender\\*.exe",
+                              "?:\\Program Files (x86)\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Microsoft Security Client\\*.exe",
+                              "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe"))
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
new file mode 100644
index 0000000000..bef46574cf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs]]
+=== Potential DLL SideLoading via Trusted Microsoft Programs
+
+Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and
+  not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe") or
+         process.executable : ("?:\\Windows\\explorer.exe",
+                               "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Windows\\System32\\Dism.exe",
+                               "?:\\Windows\\SysWOW64\\Dism.exe",
+                               "?:\\Windows\\System32\\inetsrv\\w3wp.exe")
+         )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-scan-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-scan-detected.asciidoc
new file mode 100644
index 0000000000..51bd5d9b1a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-scan-detected.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-11-1-potential-network-scan-detected]]
+=== Potential Network Scan Detected
+
+This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-network_traffic.*
+* packetbeat-*
+* filebeat-*
+* auditbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port : * and event.action : "network_flow" and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-sweep-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-sweep-detected.asciidoc
new file mode 100644
index 0000000000..51e4be414d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-network-sweep-detected.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-11-1-potential-network-sweep-detected]]
+=== Potential Network Sweep Detected
+
+This rule identifies a potential network sweep.  A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+* logs-endpoint.events.network-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986) and 
+source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
new file mode 100644
index 0000000000..cdc5bdf1a7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity]]
+=== Potential OpenSSH Backdoor Logging Activity
+
+Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/eset/malware-ioc/tree/master/sshdoor
+* https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "change" and process.executable : ("/usr/sbin/sshd", "/usr/bin/ssh") and
+  (
+    (file.name : (".*", "~*", "*~") and not file.name : (".cache", ".viminfo", ".bash_history")) or
+    file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or
+    file.path :
+    (
+      "/private/etc/*--",
+      "/usr/share/*",
+      "/usr/include/*",
+      "/usr/local/include/*",
+      "/private/tmp/*",
+      "/private/var/tmp/*",
+      "/usr/tmp/*",
+      "/usr/share/man/*",
+      "/usr/local/share/*",
+      "/usr/lib/*.so.*",
+      "/private/etc/ssh/.sshd_auth",
+      "/usr/bin/ssd",
+      "/private/var/opt/power",
+      "/private/etc/ssh/ssh_known_hosts",
+      "/private/var/html/lol",
+      "/private/var/log/utmp",
+      "/private/var/lib",
+      "/var/run/sshd/sshd.pid",
+      "/var/run/nscd/ns.pid",
+      "/var/run/udev/ud.pid",
+      "/var/run/udevd.pid"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Compromise Client Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names.asciidoc
new file mode 100644
index 0000000000..66a9fe2259
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -0,0 +1,256 @@
+[[prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names]]
+=== Potential PowerShell HackTool Script by Function Names
+
+Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+* https://github.com/BC-SECURITY/Empire
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: PowerShell Logs
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Add-DomainGroupMember" or "Add-DomainObjectAcl" or
+    "Add-RemoteConnection" or "Add-ServiceDacl" or
+    "Add-Win32Type" or "Convert-ADName" or
+    "Convert-LDAPProperty" or "ConvertFrom-LDAPLogonHours" or
+    "ConvertFrom-UACValue" or "Copy-ArrayOfMemAddresses" or
+    "Create-NamedPipe" or "Create-ProcessWithToken" or
+    "Create-RemoteThread" or "Create-SuspendedWinLogon" or
+    "Create-WinLogonProcess" or "Emit-CallThreadStub" or
+    "Enable-SeAssignPrimaryTokenPrivilege" or "Enable-SeDebugPrivilege" or
+    "Enum-AllTokens" or "Export-PowerViewCSV" or
+    "Find-AVSignature" or "Find-AppLockerLog" or
+    "Find-DomainLocalGroupMember" or "Find-DomainObjectPropertyOutlier" or
+    "Find-DomainProcess" or "Find-DomainShare" or
+    "Find-DomainUserEvent" or "Find-DomainUserLocation" or
+    "Find-InterestingDomainAcl" or "Find-InterestingDomainShareFile" or
+    "Find-InterestingFile" or "Find-LocalAdminAccess" or
+    "Find-PSScriptsInPSAppLog" or "Find-PathDLLHijack" or
+    "Find-ProcessDLLHijack" or "Find-RDPClientConnection" or
+    "Get-AllAttributesForClass" or "Get-CachedGPPPassword" or
+    "Get-DecryptedCpassword" or "Get-DecryptedSitelistPassword" or
+    "Get-DelegateType" or
+    "Get-DomainDFSShare" or "Get-DomainDFSShareV1" or
+    "Get-DomainDFSShareV2" or "Get-DomainDNSRecord" or
+    "Get-DomainDNSZone" or "Get-DomainFileServer" or
+    "Get-DomainForeignGroupMember" or "Get-DomainForeignUser" or
+    "Get-DomainGPO" or "Get-DomainGPOComputerLocalGroupMapping" or
+    "Get-DomainGPOLocalGroup" or "Get-DomainGPOUserLocalGroupMapping" or
+    "Get-DomainGUIDMap" or "Get-DomainGroup" or
+    "Get-DomainGroupMember" or "Get-DomainGroupMemberDeleted" or
+    "Get-DomainManagedSecurityGroup" or "Get-DomainOU" or
+    "Get-DomainObject" or "Get-DomainObjectAcl" or
+    "Get-DomainObjectAttributeHistory" or "Get-DomainObjectLinkedAttributeHistory" or
+    "Get-DomainPolicyData" or "Get-DomainSID" or
+    "Get-DomainSPNTicket" or "Get-DomainSearcher" or
+    "Get-DomainSite" or "Get-DomainSubnet" or
+    "Get-DomainTrust" or "Get-DomainTrustMapping" or
+    "Get-DomainUser" or "Get-DomainUserEvent" or
+    "Get-Forest" or "Get-ForestDomain" or
+    "Get-ForestGlobalCatalog" or "Get-ForestSchemaClass" or
+    "Get-ForestTrust" or "Get-GPODelegation" or
+    "Get-GPPAutologon" or "Get-GPPInnerField" or
+    "Get-GPPInnerFields" or "Get-GPPPassword" or
+    "Get-GptTmpl" or "Get-GroupsXML" or
+    "Get-HttpStatus" or "Get-ImageNtHeaders" or
+    "Get-Keystrokes" or
+    "Get-MemoryProcAddress" or "Get-MicrophoneAudio" or
+    "Get-ModifiablePath" or "Get-ModifiableRegistryAutoRun" or
+    "Get-ModifiableScheduledTaskFile" or "Get-ModifiableService" or
+    "Get-ModifiableServiceFile" or "Get-Name" or
+    "Get-NetComputerSiteName" or "Get-NetLocalGroup" or
+    "Get-NetLocalGroupMember" or "Get-NetLoggedon" or
+    "Get-NetRDPSession" or "Get-NetSession" or
+    "Get-NetShare" or "Get-PEArchitecture" or
+    "Get-PEBasicInfo" or "Get-PEDetailedInfo" or
+    "Get-PathAcl" or "Get-PrimaryToken" or
+    "Get-ProcAddress" or "Get-ProcessTokenGroup" or
+    "Get-ProcessTokenPrivilege" or "Get-ProcessTokenType" or
+    "Get-RegLoggedOn" or "Get-RegistryAlwaysInstallElevated" or
+    "Get-RegistryAutoLogon" or "Get-RemoteProcAddress" or
+    "Get-Screenshot" or "Get-ServiceDetail" or
+    "Get-SiteListPassword" or "Get-SitelistField" or
+    "Get-System" or "Get-SystemNamedPipe" or
+    "Get-SystemToken" or "Get-ThreadToken" or
+    "Get-TimedScreenshot" or "Get-TokenInformation" or
+    "Get-TopPort" or "Get-UnattendedInstallFile" or
+    "Get-UniqueTokens" or "Get-UnquotedService" or
+    "Get-VaultCredential" or "Get-VaultElementValue" or
+    "Get-VirtualProtectValue" or "Get-VolumeShadowCopy" or
+    "Get-WMIProcess" or "Get-WMIRegCachedRDPConnection" or
+    "Get-WMIRegLastLoggedOn" or "Get-WMIRegMountedDrive" or
+    "Get-WMIRegProxy" or "Get-WebConfig" or
+    "Get-Win32Constants" or "Get-Win32Functions" or
+    "Get-Win32Types" or "Import-DllImports" or
+    "Import-DllInRemoteProcess" or "Inject-LocalShellcode" or
+    "Inject-RemoteShellcode" or "Install-ServiceBinary" or
+    "Invoke-CompareAttributesForClass" or "Invoke-CreateRemoteThread" or
+    "Invoke-CredentialInjection" or "Invoke-DllInjection" or
+    "Invoke-EventVwrBypass" or "Invoke-ImpersonateUser" or
+    "Invoke-Kerberoast" or "Invoke-MemoryFreeLibrary" or
+    "Invoke-MemoryLoadLibrary" or "Invoke-Method" or
+    "Invoke-Mimikatz" or "Invoke-NinjaCopy" or
+    "Invoke-PatchDll" or "Invoke-Portscan" or
+    "Invoke-PrivescAudit" or "Invoke-ReflectivePEInjection" or
+    "Invoke-ReverseDnsLookup" or "Invoke-RevertToSelf" or
+    "Invoke-ServiceAbuse" or "Invoke-Shellcode" or
+    "Invoke-TokenManipulation" or "Invoke-UserImpersonation" or
+    "Invoke-WmiCommand" or "Mount-VolumeShadowCopy" or
+    "New-ADObjectAccessControlEntry" or "New-DomainGroup" or
+    "New-DomainUser" or "New-DynamicParameter" or
+    "New-InMemoryModule" or
+    "New-ThreadedFunction" or "New-VolumeShadowCopy" or
+    "Out-CompressedDll" or "Out-EncodedCommand" or
+    "Out-EncryptedScript" or "Out-Minidump" or
+    "PortScan-Alive" or "Portscan-Port" or
+    "Remove-DomainGroupMember" or "Remove-DomainObjectAcl" or
+    "Remove-RemoteConnection" or "Remove-VolumeShadowCopy" or
+    "Restore-ServiceBinary" or "Set-DesktopACLToAllowEveryone" or
+    "Set-DesktopACLs" or "Set-DomainObject" or
+    "Set-DomainObjectOwner" or "Set-DomainUserPassword" or
+    "Set-ServiceBinaryPath" or "Sub-SignedIntAsUnsigned" or
+    "Test-AdminAccess" or "Test-MemoryRangeValid" or
+    "Test-ServiceDaclPermission" or "Update-ExeFunctions" or
+    "Update-MemoryAddresses" or "Update-MemoryProtectionFlags" or
+    "Write-BytesToMemory" or "Write-HijackDll" or
+    "Write-PortscanOut" or "Write-ServiceBinary" or
+    "Write-UserAddMSI" or "Invoke-Privesc" or
+    "func_get_proc_address" or "Invoke-BloodHound" or
+    "Invoke-HostEnum" or "Get-BrowserInformation" or
+    "Get-DomainAccountPolicy" or "Get-DomainAdmins" or
+    "Get-AVProcesses" or "Get-AVInfo" or
+    "Get-RecycleBin" or "Invoke-BruteForce" or
+    "Get-PassHints" or "Invoke-SessionGopher" or
+    "Get-LSASecret" or "Get-PassHashes" or
+    "Invoke-WdigestDowngrade" or "Get-ChromeDump" or
+    "Invoke-DomainPasswordSpray" or "Get-FoxDump" or
+    "New-HoneyHash" or "Invoke-DCSync" or
+    "Invoke-PowerDump" or "Invoke-SSIDExfil" or
+    "Invoke-PowerShellTCP" or "Add-Exfiltration" or
+    "Do-Exfiltration" or "Invoke-DropboxUpload" or
+    "Invoke-ExfilDataToGitHub" or "Invoke-EgressCheck" or
+    "Invoke-PostExfil" or "Create-MultipleSessions" or
+    "Invoke-NetworkRelay" or "New-GPOImmediateTask" or
+    "Invoke-WMIDebugger" or "Invoke-SQLOSCMD" or
+    "Invoke-SMBExec" or "Invoke-PSRemoting" or
+    "Invoke-ExecuteMSBuild" or "Invoke-DCOM" or
+    "Invoke-InveighRelay" or "Invoke-PsExec" or
+    "Invoke-SSHCommand" or "Find-ActiveUsersWMI" or
+    "Get-SystemDrivesWMI" or "Get-ActiveNICSWMI" or
+    "Remove-Persistence" or "DNS_TXT_Pwnage" or
+    "Execute-OnTime" or "HTTP-Backdoor" or
+    "Add-ConstrainedDelegationBackdoor" or "Add-RegBackdoor" or
+    "Add-ScrnSaveBackdoor" or "Gupt-Backdoor" or
+    "Invoke-ADSBackdoor" or "Add-Persistence" or
+    "Invoke-ResolverBackdoor" or "Invoke-EventLogBackdoor" or
+    "Invoke-DeadUserBackdoor" or "Invoke-DisableMachineAcctChange" or
+    "Invoke-AccessBinary" or "Add-NetUser" or
+    "Invoke-Schtasks" or "Invoke-JSRatRegsvr" or
+    "Invoke-JSRatRundll" or "Invoke-PoshRatHttps" or
+    "Invoke-PsGcatAgent" or "Remove-PoshRat" or
+    "Install-SSP" or "Invoke-BackdoorLNK" or
+    "PowerBreach" or "InstallEXE-Persistence" or
+    "RemoveEXE-Persistence" or "Install-ServiceLevel-Persistence" or
+    "Remove-ServiceLevel-Persistence" or "Invoke-Prompt" or
+    "Invoke-PacketCapture" or "Start-WebcamRecorder" or
+    "Get-USBKeyStrokes" or "Invoke-KeeThief" or
+    "Get-Keystrokes" or "Invoke-NetRipper" or
+    "Get-EmailItems" or "Invoke-MailSearch" or
+    "Invoke-SearchGAL" or "Get-WebCredentials" or
+    "Start-CaptureServer" or "Invoke-PowerShellIcmp" or
+    "Invoke-PowerShellTcpOneLine" or "Invoke-PowerShellTcpOneLineBind" or
+    "Invoke-PowerShellUdp" or "Invoke-PowerShellUdpOneLine" or
+    "Run-EXEonRemote" or "Download-Execute-PS" or
+    "Out-RundllCommand" or "Set-RemoteWMI" or
+    "Set-DCShadowPermissions" or "Invoke-PowerShellWMI" or
+    "Invoke-Vnc" or "Invoke-LockWorkStation" or
+    "Invoke-EternalBlue" or "Invoke-ShellcodeMSIL" or
+    "Invoke-MetasploitPayload" or "Invoke-DowngradeAccount" or
+    "Invoke-RunAs" or "ExetoText" or
+    "Disable-SecuritySettings" or "Set-MacAttribute" or
+    "Invoke-MS16032" or "Invoke-BypassUACTokenManipulation" or
+    "Invoke-SDCLTBypass" or "Invoke-FodHelperBypass" or
+    "Invoke-EventVwrBypass" or "Invoke-EnvBypass" or
+    "Get-ServiceUnquoted" or "Get-ServiceFilePermission" or
+    "Get-ServicePermission" or "Get-ServicePermission" or
+    "Enable-DuplicateToken" or "Invoke-PsUaCme" or
+    "Invoke-Tater" or "Invoke-WScriptBypassUAC" or
+    "Invoke-AllChecks" or "Find-TrustedDocuments" or
+    "Invoke-Interceptor" or "Invoke-PoshRatHttp" or
+    "Invoke-ExecCommandWMI" or "Invoke-KillProcessWMI" or
+    "Invoke-CreateShareandExecute" or "Invoke-RemoteScriptWithOutput" or
+    "Invoke-SchedJobManipulation" or "Invoke-ServiceManipulation" or
+    "Invoke-PowerOptionsWMI" or "Invoke-DirectoryListing" or
+    "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or
+    "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or
+    "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS"
+  ) and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint"
+  ) and
+  not user.id : ("S-1-5-18" or "S-1-5-19")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911.asciidoc
new file mode 100644
index 0000000000..2951db0cbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911.asciidoc
@@ -0,0 +1,86 @@
+[[prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911]]
+=== Potential Privilege Escalation via CVE-2023-4911
+
+This rule detects potential privilege escalation attempts through Looney Tunables (CVE-2023-4911). Looney Tunables is a buffer overflow vulnerability in GNU C Library's dynamic loader's processing of the GLIBC_TUNABLES environment variable.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.qualys.com/vulnerabilities-threat-research/2023/10/03/cve-2023-4911-looney-tunables-local-privilege-escalation-in-the-glibcs-ld-so
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Setup
+Elastic Defend integration does not collect environment variable logging by default.
+In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings
+of the Elastic Defend integration.
+To set up environment variable capture for an Elastic Agent policy:
+- Go to Security → Manage → Policies.
+- Select an Elastic Agent policy.
+- Click Show advanced settings.
+- Scroll down or search for linux.advanced.capture_env_vars.
+- Enter the names of env vars you want to capture, separated by commas.
+- For this rule the linux.advanced.capture_env_vars variable should be set to "GLIBC_TUNABLES".
+- Click Save.
+After saving the integration change, the Elastic Agents running this policy will be updated and
+the rule will function properly.
+For more information on capturing environment variables refer - https://www.elastic.co/guide/en/security/current/environment-variable-capture.html
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.parent.entity_id, process.executable with maxspan=5s
+ [process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
+  process.env_vars : "*GLIBC_TUNABLES=glibc.*=glibc.*=*"] with runs=5
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
new file mode 100644
index 0000000000..28ac629ccc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
@@ -0,0 +1,107 @@
+[[prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm]]
+=== Potential Protocol Tunneling via EarthWorm
+
+Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://rootkiter.com/EarthWorm/
+* https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.type == "start" and
+ process.args : "-s" and process.args : "-d" and process.args : "rssocks"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected.asciidoc
new file mode 100644
index 0000000000..c06756d3e9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected.asciidoc
@@ -0,0 +1,93 @@
+[[prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected]]
+=== Potential Pspy Process Monitoring Detected
+
+This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-auditd_manager.auditd-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/DominicBreuker/pspy
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Discovery
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Auditd Manager Integration Setup
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Auditd Manager and select the integration to see more details about it.
+- Click Add Auditd Manager.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click Save and Continue.
+- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager).
+
+#### Rule Specific Setup Note
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule the following additional audit rules are required to be added to the integration:
+  -- "-w /proc/ -p r -k audit_proc"
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by process.pid, host.id with maxspan=5s
+[ file where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+  auditd.data.syscall == "openat" and file.path == "/proc" and auditd.data.a0 : ("ffffffffffffff9c", "ffffff9c") and 
+  auditd.data.a2 : ("80000", "88000") ] with runs=10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process.asciidoc
new file mode 100644
index 0000000000..ef9e5ef070
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process]]
+=== Potential Reverse Shell via Background Process
+
+Monitors for the execution of background processes with process arguments capable of opening a socket in the /dev/tcp channel. This may indicate the creation of a backdoor reverse connection, and should be investigated further.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "linux" and event.action == "exec" and event.type == "start" and 
+process.name in ("setsid", "nohup") and process.args : "*/dev/tcp/*0>&1*" and 
+process.parent.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..8cedc5b6d6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,108 @@
+[[prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected]]
+=== Potential Successful Linux FTP Brute Force Attack Detected
+
+An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+### Auditd Manager Integration Setup
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Auditd Manager and select the integration to see more details about it.
+- Click Add Auditd Manager.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click Save and Continue.
+- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager).
+
+#### Rule Specific Setup Note
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, auditd.data.addr, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "failure" and 
+   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action  == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "success" and 
+   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
new file mode 100644
index 0000000000..3da07cf3fe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -0,0 +1,106 @@
+[[prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected]]
+=== Potential Successful Linux RDP Brute Force Attack Detected
+
+An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-auditd_manager.auditd-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+### Auditd Manager Integration Setup
+The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
+Auditd Manager provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system.
+
+#### The following steps should be executed in order to add the Elastic Agent System integration "auditd_manager" on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Auditd Manager and select the integration to see more details about it.
+- Click Add Auditd Manager.
+- Configure the integration name and optionally add a description.
+- Review optional and advanced settings accordingly.
+- Add the newly installed `auditd manager` to an existing or a new agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.
+- Click Save and Continue.
+- For more details on the integeration refer to the [helper guide](https://docs.elastic.co/integrations/auditd_manager).
+
+#### Rule Specific Setup Note
+Auditd Manager subscribes to the kernel and receives events as they occur without any additional configuration.
+However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the "audit rules" configuration box or the "auditd rule files" box by specifying a file to read the audit rules from.
+- For this detection rule no additional audit rules are required to be added to the integration.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, related.user with maxspan=5s
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "failure"] with runs=10
+  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and 
+   event.action  == "authenticated" and auditd.data.terminal : "*rdp*" and event.outcome == "success"] | tail 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Brute Force
+** ID: T1110
+** Reference URL: https://attack.mitre.org/techniques/T1110/
+* Sub-technique:
+** Name: Password Guessing
+** ID: T1110.001
+** Reference URL: https://attack.mitre.org/techniques/T1110/001/
+* Sub-technique:
+** Name: Password Spraying
+** ID: T1110.003
+** Reference URL: https://attack.mitre.org/techniques/T1110/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected.asciidoc
new file mode 100644
index 0000000000..a14cc458ac
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected.asciidoc
@@ -0,0 +1,74 @@
+[[prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected]]
+=== Potential SYN-Based Network Scan Detected
+
+This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* logs-network_traffic.*
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Network
+* Tactic: Discovery
+* Tactic: Reconnaissance
+* Use Case: Network Security Monitoring
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+destination.port : * and network.packets <= 2 and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Network Service Discovery
+** ID: T1046
+** Reference URL: https://attack.mitre.org/techniques/T1046/
+* Tactic:
+** Name: Reconnaissance
+** ID: TA0043
+** Reference URL: https://attack.mitre.org/tactics/TA0043/
+* Technique:
+** Name: Active Scanning
+** ID: T1595
+** Reference URL: https://attack.mitre.org/techniques/T1595/
+* Sub-technique:
+** Name: Scanning IP Blocks
+** ID: T1595.001
+** Reference URL: https://attack.mitre.org/techniques/T1595/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-kerberos-ticket-request.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-kerberos-ticket-request.asciidoc
new file mode 100644
index 0000000000..27239ba7e4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-kerberos-ticket-request.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-11-1-powershell-kerberos-ticket-request]]
+=== PowerShell Kerberos Ticket Request
+
+Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://cobalt.io/blog/kerberoast-attack-techniques
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Kerberos Ticket Request
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.
+
+Accounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute force to crack the user password, which is used to encrypt a Kerberos TGS ticket.
+
+Attackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to perform Kerberoasting.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate if the script was executed, and if so, which account was targeted.
+- Validate if the account has an SPN associated with it.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Check if the script has any other functionality that can be potentially malicious.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769) related to this account and service name for additional information.
+
+### False positive analysis
+
+- A possible false positive can be identified if the script content is not malicious/harmful or does not request Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password requirements and policy.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    KerberosRequestorSecurityToken
+  ) and not user.id : ("S-1-5-18" or "S-1-5-20") and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
+* Sub-technique:
+** Name: Kerberoasting
+** ID: T1558.003
+** Reference URL: https://attack.mitre.org/techniques/T1558/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-mailbox-collection-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-mailbox-collection-script.asciidoc
new file mode 100644
index 0000000000..6ab6ff565f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-mailbox-collection-script.asciidoc
@@ -0,0 +1,140 @@
+[[prebuilt-rule-8-11-1-powershell-mailbox-collection-script]]
+=== PowerShell Mailbox Collection Script
+
+Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/dafthack/MailSniper/blob/master/MailSniper.ps1
+* https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Mailbox Collection Script
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
+
+This rule identifies scripts that contains methods and classes that can be abused to collect emails from local and remote mailboxes.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Determine whether the script was executed and capture relevant information, such as arguments that reveal intent or are indicators of compromise (IoCs).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+  - Assess network data to determine if the host communicated with the exfiltration server.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+### Related rules
+
+- Exporting Exchange Mailbox via PowerShell - 6aace640-e631-4870-ba8e-5fdda09325db
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (
+   powershell.file.script_block_text : (
+      "Microsoft.Office.Interop.Outlook" or
+      "Interop.Outlook.olDefaultFolders" or
+      "::olFolderInBox"
+   ) or
+   powershell.file.script_block_text : (
+      "Microsoft.Exchange.WebServices.Data.Folder" or
+      "Microsoft.Exchange.WebServices.Data.FileAttachment"
+   )
+  ) and not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
new file mode 100644
index 0000000000..92bb23916a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
@@ -0,0 +1,157 @@
+[[prebuilt-rule-8-11-1-powershell-psreflect-script]]
+=== PowerShell PSReflect Script
+
+Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell PSReflect Script
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+PSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to create enums and structs easily—all without touching the disk.
+
+Although this is an interesting project for every developer and admin out there, it is mainly used in the red team and malware tooling for its capabilities.
+
+Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics. The script content that may be split into multiple script blocks (you can use the field `powershell.file.script_block_id` for filtering).
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Check for additional PowerShell and command-line logs that indicate that imported functions were run.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Related rules
+
+- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
+- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
+- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "New-InMemoryModule" or
+    "Add-Win32Type" or
+    psenum or
+    DefineDynamicAssembly or
+    DefineDynamicModule or
+    "Reflection.TypeAttributes" or
+    "Reflection.Emit.OpCodes" or
+    "Reflection.Emit.CustomAttributeBuilder" or
+    "Runtime.InteropServices.DllImportAttribute"
+  ) and
+  not user.id : "S-1-5-18" and
+  not file.path : ?\:\\\\ProgramData\\\\MaaS360\\\\Cloud?Extender\\\\AR\\\\Scripts\\\\ASModuleCommon.ps1*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities.asciidoc
new file mode 100644
index 0000000000..712f79f70c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities.asciidoc
@@ -0,0 +1,122 @@
+[[prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities]]
+=== PowerShell Script with Token Impersonation Capabilities
+
+Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/decoder-it/psgetsystem
+* https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/Get-System.ps1
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: PowerShell Logs
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "Invoke-TokenManipulation" or
+    "ImpersonateNamedPipeClient" or
+    "NtImpersonateThread" or
+    (
+      "STARTUPINFOEX" and
+      "UpdateProcThreadAttribute"
+    ) or
+    (
+      "AdjustTokenPrivileges" and
+      "SeDebugPrivilege"
+    ) or
+    (
+      ("DuplicateToken" or
+      "DuplicateTokenEx") and
+      ("SetThreadToken" or
+      "ImpersonateLoggedOnUser" or
+      "CreateProcessWithTokenW" or
+      "CreatePRocessAsUserW" or
+      "CreateProcessAsUserA")
+    ) 
+  ) and
+  not (
+    user.id:("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and
+    file.directory: "C:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Downloads"
+  ) and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
new file mode 100644
index 0000000000..9b627f1523
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed]]
+=== PowerShell Suspicious Payload Encoded and Compressed
+
+Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Suspicious Payload Encoded and Compressed
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
+
+### Related rules
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    (
+      "System.IO.Compression.DeflateStream" or
+      "System.IO.Compression.GzipStream" or
+      "IO.Compression.DeflateStream" or
+      "IO.Compression.GzipStream"
+    ) and
+    FromBase64String
+  ) and
+  not file.path: ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\Downloads\\\\* and
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
new file mode 100644
index 0000000000..3bf71ca139
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities]]
+=== PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.
+
+#### Possible investigation steps
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+- Assess network data to determine if the host communicated with the exfiltration server.
+
+### False positive analysis
+
+- Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+### Related rules
+
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (powershell.file.script_block_text : (
+    "Windows.Clipboard" or
+    "Windows.Forms.Clipboard" or
+    "Windows.Forms.TextBox"
+   ) and
+   powershell.file.script_block_text : (
+    "]::GetText" or
+    ".Paste()"
+  )) or powershell.file.script_block_text : "Get-Clipboard" and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  ) and
+  not user.id : "S-1-5-18" and
+  not file.path : (
+        ?\:\\\\program?files\\\\powershell\\\\?\\\\Modules\\\\*.psd1 or
+        ?\:\\\\Windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or
+        ?\:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or
+        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or
+        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psm1
+      ) and 
+  not (
+    file.path : ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\*Modules*.ps1 and
+    file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Clipboard Data
+** ID: T1115
+** Reference URL: https://attack.mitre.org/techniques/T1115/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc
new file mode 100644
index 0000000000..b7416662a4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc
@@ -0,0 +1,108 @@
+[[prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet]]
+=== RDP (Remote Desktop Protocol) from the Internet
+
+This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory.asciidoc
new file mode 100644
index 0000000000..08a2d3776f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory.asciidoc
@@ -0,0 +1,71 @@
+[[prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory]]
+=== Remote File Creation on a Sensitive Directory
+
+Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these directories could indicate a malicious binary or script trying to compromise the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/es/blog/remote-desktop-protocol-connections-elastic-security
+
+*Tags*: 
+
+* Domain: Endpoint
+* Use Case: Lateral Movement Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where (event.action == "creation" or event.action == "modification") and
+process.name:("System", "scp", "sshd", "smbd", "vsftpd", "sftp-server") and not
+user.name:("SYSTEM", "root") and
+(file.path : ("C*\\Users\\*\\AppData\\Roaming*", "C*\\Program*Files\\*",
+    "C*\\Windows\\*", "C*\\Windows\\System\\*",
+    "C*\\Windows\\System32\\*", "/etc/*", "/tmp*",
+    "/var/tmp*", "/home/*/.*", "/home/.*", "/usr/bin/*",
+    "/sbin/*", "/bin/*", "/usr/lib/*", "/usr/sbin/*",
+    "/usr/share/*", "/usr/local/*", "/var/lib/dpkg/*",
+    "/lib/systemd/*"
+    )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
new file mode 100644
index 0000000000..86bfdeaaa2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc
@@ -0,0 +1,109 @@
+[[prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet]]
+=== Roshal Archive (RAR) or PowerShell File Downloaded from the Internet
+
+Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
+* https://www.justice.gov/opa/press-release/file/1084361/download
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Domain: Endpoint
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Threat intel
+
+This activity has been observed in FIN7 campaigns.
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: (network_traffic.http or network_traffic.tls) or
+  (event.category: (network or network_traffic) and network.protocol: http)) and
+  (url.extension:(ps1 or rar) or url.path:(*.ps1 or *.rar)) and
+    not destination.ip:(
+      10.0.0.0/8 or
+      127.0.0.0/8 or
+      169.254.0.0/16 or
+      172.16.0.0/12 or
+      192.0.0.0/24 or
+      192.0.0.0/29 or
+      192.0.0.8/32 or
+      192.0.0.9/32 or
+      192.0.0.10/32 or
+      192.0.0.170/32 or
+      192.0.0.171/32 or
+      192.0.2.0/24 or
+      192.31.196.0/24 or
+      192.52.193.0/24 or
+      192.168.0.0/16 or
+      192.88.99.0/24 or
+      224.0.0.0/4 or
+      100.64.0.0/10 or
+      192.175.48.0/24 or
+      198.18.0.0/15 or
+      198.51.100.0/24 or
+      203.0.113.0/24 or
+      240.0.0.0/4 or
+      "::1" or
+      "FE80::/10" or
+      "FF00::/8"
+    ) and
+    source.ip:(
+      10.0.0.0/8 or
+      172.16.0.0/12 or
+      192.168.0.0/16
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet.asciidoc
new file mode 100644
index 0000000000..c5f67d4490
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet]]
+=== RPC (Remote Procedure Call) from the Internet
+
+This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet.asciidoc
new file mode 100644
index 0000000000..263c0a28df
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet]]
+=== RPC (Remote Procedure Call) to the Internet
+
+This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc
new file mode 100644
index 0000000000..a48c208d19
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet]]
+=== SMB (Windows File Sharing) Activity to the Internet
+
+This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Initial Access
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Alternative Protocol
+** ID: T1048
+** Reference URL: https://attack.mitre.org/techniques/T1048/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smtp-on-port-26-tcp.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smtp-on-port-26-tcp.asciidoc
new file mode 100644
index 0000000000..8c61cb6b16
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-smtp-on-port-26-tcp.asciidoc
@@ -0,0 +1,68 @@
+[[prebuilt-rule-8-11-1-smtp-on-port-26-tcp]]
+=== SMTP on Port 26/TCP
+
+This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://unit42.paloaltonetworks.com/unit42-badpatch/
+* https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 103
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+    network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Alternative Protocol
+** ID: T1048
+** Reference URL: https://attack.mitre.org/techniques/T1048/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip.asciidoc
new file mode 100644
index 0000000000..2b2e35f34c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip]]
+=== Spike in Number of Connections Made from a Source IP
+
+A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of valuable assets, data, or further access points.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
new file mode 100644
index 0000000000..68fc97b4a4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip]]
+=== Spike in Number of Connections Made to a Destination IP
+
+A machine learning job has detected a high count of source IPs establishing an RDP connection with a single destination IP. Attackers might use multiple compromised systems to attack a target to ensure redundancy in case a source IP gets detected and blocked.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session.asciidoc
new file mode 100644
index 0000000000..fd4d4a4d62
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session]]
+=== Spike in Number of Processes in an RDP Session
+
+A machine learning job has detected unusually high number of processes started in a single RDP session. Executing a large number of processes remotely on other machines can be an indicator of lateral movement activity.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-remote-file-transfers.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-remote-file-transfers.asciidoc
new file mode 100644
index 0000000000..21c61ab6fc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-spike-in-remote-file-transfers.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-spike-in-remote-file-transfers]]
+=== Spike in Remote File Transfers
+
+A machine learning job has detected an abnormal volume of remote files shared on the host indicating potential lateral movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate valuable information. Attackers might perform multiple small transfers to match normal egress activity in the network, to evade detection.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-90m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload.asciidoc
new file mode 100644
index 0000000000..4e5d22fdc6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload.asciidoc
@@ -0,0 +1,119 @@
+[[prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload]]
+=== Suspicious PowerShell Engine ImageLoad
+
+Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 208
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Suspicious PowerShell Engine ImageLoad
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called "PowerShell without PowerShell," works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Retrieve the implementation (DLL, executable, etc.) and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+### False positive analysis
+
+- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:library and 
+  dll.name:("System.Management.Automation.dll" or "System.Management.Automation.ni.dll") and 
+  not (process.code_signature.subject_name:("Microsoft Corporation" or "Microsoft Dynamic Code Publisher" or "Microsoft Windows") and process.code_signature.trusted:true and not process.name.caseless:("regsvr32.exe" or "rundll32.exe")) and 
+  not (process.executable.caseless:(?\:\\\\Program?Files?\(x86\)\\\\*.exe or ?\:\\\\Program?Files\\\\*.exe) and process.code_signature.trusted:true) and 
+  not (process.executable.caseless:?\:\\\\Windows\\\\Lenovo\\\\*.exe and process.code_signature.subject_name:"Lenovo" and 
+  process.code_signature.trusted:true) and not process.executable.caseless : "C:\\Windows\\System32\\powershell.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
new file mode 100644
index 0000000000..267381cf82
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -0,0 +1,106 @@
+[[prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable]]
+=== Suspicious Process Execution via Renamed PsExec Executable
+
+Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Suspicious Process Execution via Renamed PsExec Executable
+
+PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
+
+This rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.
+
+#### Possible investigation steps
+
+- Check if the usage of this tool complies with the organization's administration policy.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Identify the target computer and its role in the IT environment.
+- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+### False positive analysis
+
+- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "psexesvc.exe" and not process.name : "PSEXESVC.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: System Services
+** ID: T1569
+** Reference URL: https://attack.mitre.org/techniques/T1569/
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
new file mode 100644
index 0000000000..50004626ba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-11-1-svchost-spawning-cmd]]
+=== Svchost spawning Cmd
+
+Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 207
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+## Triage and analysis
+
+### Investigating Svchost spawning Cmd
+
+The Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be used by non-Windows services.
+
+This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
+
+> **Note**:
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+#### Possible investigation steps
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+### False positive analysis
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+### Response and remediation
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and process.parent.name:"svchost.exe" and 
+process.name.caseless:"cmd.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
new file mode 100644
index 0000000000..4731f9fe8f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-11-1-system-log-file-deletion]]
+=== System Log File Deletion
+
+Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* auditbeat-*
+* logs-endpoint.events.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+### Elastic Defend Integration Setup
+Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows
+the Elastic Agent to monitor events on your host and send data to the Elastic Security app.
+
+#### Prerequisite Requirements:
+- Fleet is required for Elastic Defend.
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+
+#### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
+- Go to the Kibana home page and click Add integrations.
+- In the query bar, search for Elastic Defend and select the integration to see more details about it.
+- Click Add Elastic Defend.
+- Configure the integration name and optionally add a description.
+- Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
+- Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+- Click Save and Continue.
+- To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+
+### Auditbeat Setup
+Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
+
+#### The following steps should be executed in order to add the Auditbeat for Linux System:
+- Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+
+#### Custom Ingest Pipeline
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+----------------------------------
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "linux" and event.type == "deletion" and
+  file.path :
+    (
+    "/var/run/utmp",
+    "/var/log/wtmp",
+    "/var/log/btmp",
+    "/var/log/lastlog",
+    "/var/log/faillog",
+    "/var/log/syslog",
+    "/var/log/messages",
+    "/var/log/secure",
+    "/var/log/auth.log",
+    "/var/log/boot.log",
+    "/var/log/kern.log"
+    ) and
+    not process.name : ("gzip")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Linux or Mac System Logs
+** ID: T1070.002
+** Reference URL: https://attack.mitre.org/techniques/T1070/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc
new file mode 100644
index 0000000000..5b493a566a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc
@@ -0,0 +1,60 @@
+[[prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line]]
+=== Unusual Discovery Signal Alert with Unusual Process Command Line
+
+This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id, user.id and process.command_line entries.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* .alerts-security.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: Higher-Order Rule
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:(
+  "d68e95ad-1c82-4074-a12a-125fe10ac8ba" or "7b8bfc26-81d2-435e-965c-d722ee397ef1" or
+  "0635c542-1b96-4335-9b47-126582d2c19a" or "6ea55c81-e2ba-42f2-a134-bccf857ba922" or
+  "e0881d20-54ac-457f-8733-fe0bc5d44c55" or "06568a02-af29-4f20-929c-f3af281e41aa" or
+  "c4e9ed3e-55a2-4309-a012-bc3c78dad10a" or "51176ed2-2d90-49f2-9f3d-17196428b169"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc
new file mode 100644
index 0000000000..42daa9fddd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc
@@ -0,0 +1,55 @@
+[[prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable]]
+=== Unusual Discovery Signal Alert with Unusual Process Executable
+
+This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id, user.id and process.executable entries.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* .alerts-security.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Rule Type: Higher-Order Rule
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.kind:signal and kibana.alert.rule.rule_id:"1d72d014-e2ab-4707-b056-9b96abe7b511"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-directory.asciidoc
new file mode 100644
index 0000000000..45f068cd5f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-directory.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-unusual-remote-file-directory]]
+=== Unusual Remote File Directory
+
+An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so attackers might use less common directories to bypass monitoring.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-90m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-extension.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-extension.asciidoc
new file mode 100644
index 0000000000..71ee4e9644
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-extension.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-unusual-remote-file-extension]]
+=== Unusual Remote File Extension
+
+An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential lateral movement activity on the host.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-90m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-size.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-size.asciidoc
new file mode 100644
index 0000000000..0fb58ba050
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-remote-file-size.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-unusual-remote-file-size]]
+=== Unusual Remote File Size
+
+A machine learning job has detected an unusually high file size shared by a remote host indicating potential lateral movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate valuable information. Instead of multiple small transfers that can raise alarms, attackers might choose to bundle data into a single large file transfer.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-90m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session.asciidoc
new file mode 100644
index 0000000000..2409031ed7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session.asciidoc
@@ -0,0 +1,58 @@
+[[prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session]]
+=== Unusual Time or Day for an RDP Session
+
+A machine learning job has detected an RDP session started at an usual time or weekday. An RDP session at an unusual time could be followed by other suspicious activities, so catching this is a good first step in detecting a larger attack.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-12h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/lmd
+
+*Tags*: 
+
+* Use Case: Lateral Movement Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Lateral Movement
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet.asciidoc
new file mode 100644
index 0000000000..f8f4e7d01b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet]]
+=== VNC (Virtual Network Computing) from the Internet
+
+This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow or (event.category: (network or network_traffic))) and
+  network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  not source.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  ) and
+  destination.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet.asciidoc
new file mode 100644
index 0000000000..cde8f89f7b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet]]
+=== VNC (Virtual Network Computing) to the Internet
+
+This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* packetbeat-*
+* auditbeat-*
+* filebeat-*
+* logs-network_traffic.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
+
+*Tags*: 
+
+* Tactic: Command and Control
+* Domain: Endpoint
+* Use Case: Threat Detection
+
+*Version*: 104
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+(event.dataset: network_traffic.flow  or (event.category: (network or network_traffic))) and
+  network.transport:tcp and destination.port >= 5800 and destination.port <= 5810 and
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-appendix.asciidoc
new file mode 100644
index 0000000000..b93fd50c42
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-appendix.asciidoc
@@ -0,0 +1,83 @@
+["appendix",role="exclude",id="prebuilt-rule-8-11-1-prebuilt-rules-8-11-1-appendix"]
+= Downloadable rule update v8.11.1
+
+This section lists all updates associated with version 8.11.1 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-11-1-malicious-remote-file-creation.asciidoc[]
+include::prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory.asciidoc[]
+include::prebuilt-rule-8-11-1-new-github-app-installed.asciidoc[]
+include::prebuilt-rule-8-11-1-new-github-owner-added.asciidoc[]
+include::prebuilt-rule-8-11-1-github-owner-role-granted-to-user.asciidoc[]
+include::prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session.asciidoc[]
+include::prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-remote-file-size.asciidoc[]
+include::prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-remote-file-directory.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-remote-file-extension.asciidoc[]
+include::prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip.asciidoc[]
+include::prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip.asciidoc[]
+include::prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session.asciidoc[]
+include::prebuilt-rule-8-11-1-spike-in-remote-file-transfers.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line.asciidoc[]
+include::prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc[]
+include::prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc[]
+include::prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc[]
+include::prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc[]
+include::prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc[]
+include::prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc[]
+include::prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc[]
+include::prebuilt-rule-8-11-1-accepted-default-telnet-port-connection.asciidoc[]
+include::prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon.asciidoc[]
+include::prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate.asciidoc[]
+include::prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior.asciidoc[]
+include::prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon.asciidoc[]
+include::prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity.asciidoc[]
+include::prebuilt-rule-8-11-1-smtp-on-port-26-tcp.asciidoc[]
+include::prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-network-sweep-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-network-scan-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected.asciidoc[]
+include::prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet.asciidoc[]
+include::prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node.asciidoc[]
+include::prebuilt-rule-8-11-1-abnormally-large-dns-response.asciidoc[]
+include::prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-mailbox-collection-script.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-kerberos-ticket-request.asciidoc[]
+include::prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments.asciidoc[]
+include::prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client.asciidoc[]
+include::prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application.asciidoc[]
+include::prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process.asciidoc[]
+include::prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process.asciidoc[]
+include::prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc[]
+include::prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc[]
+include::prebuilt-rule-8-11-1-enumeration-of-administrator-accounts.asciidoc[]
+include::prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe.asciidoc[]
+include::prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc[]
+include::prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc[]
+include::prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse.asciidoc[]
+include::prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office.asciidoc[]
+include::prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc[]
+include::prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload.asciidoc[]
+include::prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable.asciidoc[]
+include::prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc
new file mode 100644
index 0000000000..0840f05b5a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc
@@ -0,0 +1,166 @@
+[[prebuilt-rule-8-11-1-prebuilt-rules-8-11-1-summary]]
+[role="xpack"]
+== Update v8.11.1
+
+This section lists all updates associated with version 8.11.1 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-11-1-malicious-remote-file-creation, Malicious Remote File Creation>> | Malicious remote file creation, which can be an indicator of lateral movement activity. | new | 1 
+
+|<<prebuilt-rule-8-11-1-remote-file-creation-on-a-sensitive-directory, Remote File Creation on a Sensitive Directory>> | Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these directories could indicate a malicious binary or script trying to compromise the system. | new | 1 
+
+|<<prebuilt-rule-8-11-1-new-github-app-installed, New GitHub App Installed>> | This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks. | new | 1 
+
+|<<prebuilt-rule-8-11-1-new-github-owner-added, New GitHub Owner Added>> | Detects when a new member is added to a GitHub organization as an owner. This role provides admin level privileges. Any new owner roles should be investigated to determine it's validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. | new | 1 
+
+|<<prebuilt-rule-8-11-1-github-owner-role-granted-to-user, GitHub Owner Role Granted To User>> | This rule detects when a member is granted the organization owner role of a GitHub organization. This role provides admin level privileges. Any new owner role should be investigated to determine its validity. Unauthorized owner roles could indicate compromise within your organization and provide unlimited access to data and settings. | new | 1 
+
+|<<prebuilt-rule-8-11-1-high-mean-of-process-arguments-in-an-rdp-session, High Mean of Process Arguments in an RDP Session>> | A machine learning job has detected unusually high number of process arguments in an RDP session. Executing sophisticated attacks such as lateral movement can involve the use of complex commands, obfuscation mechanisms, redirection and piping, which in turn increases the number of arguments in a command. | new | 1 
+
+|<<prebuilt-rule-8-11-1-high-mean-of-rdp-session-duration, High Mean of RDP Session Duration>> | A machine learning job has detected unusually high mean of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-remote-file-size, Unusual Remote File Size>> | A machine learning job has detected an unusually high file size shared by a remote host indicating potential lateral movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate valuable information. Instead of multiple small transfers that can raise alarms, attackers might choose to bundle data into a single large file transfer. | new | 1 
+
+|<<prebuilt-rule-8-11-1-high-variance-in-rdp-session-duration, High Variance in RDP Session Duration>> | A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-remote-file-directory, Unusual Remote File Directory>> | An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so attackers might use less common directories to bypass monitoring. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-remote-file-extension, Unusual Remote File Extension>> | An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential lateral movement activity on the host. | new | 1 
+
+|<<prebuilt-rule-8-11-1-spike-in-number-of-connections-made-from-a-source-ip, Spike in Number of Connections Made from a Source IP>> | A machine learning job has detected a high count of destination IPs establishing an RDP connection with a single source IP. Once an attacker has gained access to one system, they might attempt to access more in the network in search of valuable assets, data, or further access points. | new | 1 
+
+|<<prebuilt-rule-8-11-1-spike-in-number-of-connections-made-to-a-destination-ip, Spike in Number of Connections Made to a Destination IP>> | A machine learning job has detected a high count of source IPs establishing an RDP connection with a single destination IP. Attackers might use multiple compromised systems to attack a target to ensure redundancy in case a source IP gets detected and blocked. | new | 1 
+
+|<<prebuilt-rule-8-11-1-spike-in-number-of-processes-in-an-rdp-session, Spike in Number of Processes in an RDP Session>> | A machine learning job has detected unusually high number of processes started in a single RDP session. Executing a large number of processes remotely on other machines can be an indicator of lateral movement activity. | new | 1 
+
+|<<prebuilt-rule-8-11-1-spike-in-remote-file-transfers, Spike in Remote File Transfers>> | A machine learning job has detected an abnormal volume of remote files shared on the host indicating potential lateral movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate valuable information. Attackers might perform multiple small transfers to match normal egress activity in the network, to evade detection. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-time-or-day-for-an-rdp-session, Unusual Time or Day for an RDP Session>> | A machine learning job has detected an RDP session started at an usual time or weekday. An RDP session at an unusual time could be followed by other suspicious activities, so catching this is a good first step in detecting a larger attack. | new | 1 
+
+|<<prebuilt-rule-8-11-1-potential-curl-cve-2023-38545-exploitation, Potential curl CVE-2023-38545 Exploitation>> | Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction with an unusual command line length. A flaw in curl version <= 8.3 makes curl vulnerable to a heap based buffer overflow during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule. | new | 1 
+
+|<<prebuilt-rule-8-11-1-potential-reverse-shell-via-background-process, Potential Reverse Shell via Background Process>> | Monitors for the execution of background processes with process arguments capable of opening a socket in the /dev/tcp channel. This may indicate the creation of a backdoor reverse connection, and should be investigated further. | new | 1 
+
+|<<prebuilt-rule-8-11-1-potential-privilege-escalation-via-cve-2023-4911, Potential Privilege Escalation via CVE-2023-4911>> | This rule detects potential privilege escalation attempts through Looney Tunables (CVE-2023-4911). Looney Tunables is a buffer overflow vulnerability in GNU C Library's dynamic loader's processing of the GLIBC_TUNABLES environment variable. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-command-line, Unusual Discovery Signal Alert with Unusual Process Command Line>> | This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id, user.id and process.command_line entries. | new | 1 
+
+|<<prebuilt-rule-8-11-1-unusual-discovery-signal-alert-with-unusual-process-executable, Unusual Discovery Signal Alert with Unusual Process Executable>> | This rule leverages alert data from various Discovery building block rules to alert on signals with unusual unique host.id, user.id and process.executable entries. | new | 1 
+
+|<<prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm, Potential Protocol Tunneling via EarthWorm>> | Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems. | update | 106 
+
+|<<prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected, Potential Successful Linux FTP Brute Force Attack Detected>> | An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication. | update | 2 
+
+|<<prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> | An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. | update | 2 
+
+|<<prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity, Potential OpenSSH Backdoor Logging Activity>> | Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration. | update | 106 
+
+|<<prebuilt-rule-8-11-1-file-made-immutable-by-chattr, File made Immutable by Chattr>> | Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.). | update | 107 
+
+|<<prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> | Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. | update | 105 
+
+|<<prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file, Creation of Hidden Shared Object File>> | Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. | update | 106 
+
+|<<prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable, Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable>> | This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior. | update | 3 
+
+|<<prebuilt-rule-8-11-1-system-log-file-deletion, System Log File Deletion>> | Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system. | update | 107 
+
+|<<prebuilt-rule-8-11-1-potential-pspy-process-monitoring-detected, Potential Pspy Process Monitoring Detected>> | This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors. | update | 2 
+
+|<<prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s, Linux Restricted Shell Breakout via Linux Binary(s)>> | Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary. | update | 109 
+
+|<<prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification, Persistence via KDE AutoStart Script or Desktop File Modification>> | Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence. | update | 106 
+
+|<<prebuilt-rule-8-11-1-accepted-default-telnet-port-connection, Accepted Default Telnet Port Connection>> | This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic. | update | 104 
+
+|<<prebuilt-rule-8-11-1-cobalt-strike-command-and-control-beacon, Cobalt Strike Command and Control Beacon>> | Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. | update | 104 
+
+|<<prebuilt-rule-8-11-1-default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> | This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. | update | 104 
+
+|<<prebuilt-rule-8-11-1-roshal-archive-rar-or-powershell-file-downloaded-from-the-internet, Roshal Archive (RAR) or PowerShell File Downloaded from the Internet>> | Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. | update | 103 
+
+|<<prebuilt-rule-8-11-1-possible-fin7-dga-command-and-control-behavior, Possible FIN7 DGA Command and Control Behavior>> | This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. | update | 103 
+
+|<<prebuilt-rule-8-11-1-halfbaked-command-and-control-beacon, Halfbaked Command and Control Beacon>> | Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. | update | 103 
+
+|<<prebuilt-rule-8-11-1-ipsec-nat-traversal-port-activity, IPSEC NAT Traversal Port Activity>> | This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. | update | 104 
+
+|<<prebuilt-rule-8-11-1-smtp-on-port-26-tcp, SMTP on Port 26/TCP>> | This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. | update | 103 
+
+|<<prebuilt-rule-8-11-1-rdp-remote-desktop-protocol-from-the-internet, RDP (Remote Desktop Protocol) from the Internet>> | This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 103 
+
+|<<prebuilt-rule-8-11-1-vnc-virtual-network-computing-from-the-internet, VNC (Virtual Network Computing) from the Internet>> | This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 104 
+
+|<<prebuilt-rule-8-11-1-vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> | This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 104 
+
+|<<prebuilt-rule-8-11-1-potential-network-sweep-detected, Potential Network Sweep Detected>> | This rule identifies a potential network sweep.  A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services. | update | 3 
+
+|<<prebuilt-rule-8-11-1-potential-network-scan-detected, Potential Network Scan Detected>> | This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports. | update | 3 
+
+|<<prebuilt-rule-8-11-1-potential-syn-based-network-scan-detected, Potential SYN-Based Network Scan Detected>> | This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port. | update | 3 
+
+|<<prebuilt-rule-8-11-1-rpc-remote-procedure-call-from-the-internet, RPC (Remote Procedure Call) from the Internet>> | This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 103 
+
+|<<prebuilt-rule-8-11-1-rpc-remote-procedure-call-to-the-internet, RPC (Remote Procedure Call) to the Internet>> | This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. | update | 103 
+
+|<<prebuilt-rule-8-11-1-smb-windows-file-sharing-activity-to-the-internet, SMB (Windows File Sharing) Activity to the Internet>> | This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. | update | 103 
+
+|<<prebuilt-rule-8-11-1-inbound-connection-to-an-unsecure-elasticsearch-node, Inbound Connection to an Unsecure Elasticsearch Node>> | Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. | update | 103 
+
+|<<prebuilt-rule-8-11-1-abnormally-large-dns-response, Abnormally Large DNS Response>> | Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service. | update | 105 
+
+|<<prebuilt-rule-8-11-1-exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 5 
+
+|<<prebuilt-rule-8-11-1-powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> | Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. | update | 6 
+
+|<<prebuilt-rule-8-11-1-powershell-mailbox-collection-script, PowerShell Mailbox Collection Script>> | Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information. | update | 5 
+
+|<<prebuilt-rule-8-11-1-powershell-kerberos-ticket-request, PowerShell Kerberos Ticket Request>> | Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts. | update | 108 
+
+|<<prebuilt-rule-8-11-1-control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> | Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. | update | 107 
+
+|<<prebuilt-rule-8-11-1-imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> | Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. | update | 107 
+
+|<<prebuilt-rule-8-11-1-microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> | An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. | update | 107 
+
+|<<prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> | An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. | update | 205 
+
+|<<prebuilt-rule-8-11-1-microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> | An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. | update | 107 
+
+|<<prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> | An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. | update | 108 
+
+|<<prebuilt-rule-8-11-1-microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> | An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. | update | 206 
+
+|<<prebuilt-rule-8-11-1-potential-dll-sideloading-via-trusted-microsoft-programs, Potential DLL SideLoading via Trusted Microsoft Programs>> | Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. | update | 106 
+
+|<<prebuilt-rule-8-11-1-potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> | Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. | update | 107 
+
+|<<prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> | Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. | update | 109 
+
+|<<prebuilt-rule-8-11-1-enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> | Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. | update | 108 
+
+|<<prebuilt-rule-8-11-1-enumerating-domain-trusts-via-nltest-exe, Enumerating Domain Trusts via NLTEST.EXE>> | Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. | update | 108 
+
+|<<prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> | Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. | update | 208 
+
+|<<prebuilt-rule-8-11-1-svchost-spawning-cmd, Svchost spawning Cmd>> | Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe | update | 207 
+
+|<<prebuilt-rule-8-11-1-enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> | Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). | update | 107 
+
+|<<prebuilt-rule-8-11-1-execution-of-file-written-or-modified-by-microsoft-office, Execution of File Written or Modified by Microsoft Office>> | Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. | update | 107 
+
+|<<prebuilt-rule-8-11-1-potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> | Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. | update | 6 
+
+|<<prebuilt-rule-8-11-1-powershell-psreflect-script, PowerShell PSReflect Script>> | Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. | update | 108 
+
+|<<prebuilt-rule-8-11-1-suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> | Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. | update | 208 
+
+|<<prebuilt-rule-8-11-1-suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> | Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. | update | 107 
+
+|<<prebuilt-rule-8-11-1-powershell-script-with-token-impersonation-capabilities, PowerShell Script with Token Impersonation Capabilities>> | Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls. | update | 8 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 28ac360395..75291fc8c9 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -1,49 +1 @@
-[[prebuilt-rules-downloadable-updates]]
-[role="xpack"]
-== Downloadable rule updates
-
-This section lists all updates to prebuilt detection rules, made available with the *Prebuilt Security Detection Rules* integration in Fleet.
-
-To update your installed rules to the latest versions, follow the instructions in <<update-prebuilt-rules>>.
-
-For previous rule updates, please navigate to the https://www.elastic.co/guide/en/security/8.9/prebuilt-rules-downloadable-updates.html[last version].
-
-[width="100%",options="header"]
-|==============================================
-|Update version |Date | New rules | Updated rules | Notes
-
-
-|<<prebuilt-rule-8-10-4-prebuilt-rules-8-10-4-summary, 8.10.4>> | 14 Oct 2023 | 21 | 56 |
-This release includes new rules for GitHub, Windows and Linux.
-New rules for GitHub include detection for organization wide applications and new repository owners.
-Linux rules include detection for CVE-2023-4911 and CVE-2023-38646 exploitation and reverse shells via background processes.
-Windows rules include detection for suspicious file extensions and user enumeration.
-Additionally, significant rule tuning for Windows PowerShell and Microsoft Build Engine rules has been added for better rule efficacy.
-
-|<<prebuilt-rule-8-10-3-prebuilt-rules-8-10-3-summary, 8.10.3>> | 18 Sep 2023 | 5 | 7 |
-This release includes new rules for Windows, Linux and Github.
-Github rules have officially been added to the prebuilt rules package.
-New rules for Windows include additional detection for suspicious shorcut files, WMI execution and persistence via Office documents.
-Regarding, Linux include additional detection for reverse shells via UDP and Meterpreter.
-Windows rules have been tuned for better rule efficacy.
-
-|<<prebuilt-rule-8-10-2-prebuilt-rules-8-10-2-summary, 8.10.2>> | 07 Sep 2023 | 14 | 505 |
-This release includes new rules for Windows, Linux and macOS.
-New rules for Windows include additional detection for LOLBins, credential access and defense evasion.
-Regarding, Linux include additional detection for privilege escalation, user enumeration and anomalous binary execution.
-New detection for macOS includes trap signal execution, hidden files and suspicious process relationships.
-Additionally, significant rule tuning for Windows and Linux rules has been added for better rule efficacy.
-
-|<<prebuilt-rule-8-10-1-prebuilt-rules-8-10-1-summary, 8.10.1>> | 17 Aug 2023 | 10 | 29 |
-This release includes new Linux rules for detecting additional privilege escalation and enumeration techniques.
-Additionally, a Windows rule has been added to detection PowerShell script execution with Webcam access.
-The `Suspicious Network Connection Attempt by Root` Linux rule has been deprecated in favor of the new privilege escalation rules.
-Rule tuning for Windows and Linux rules has been added for better rule efficacy.
-
-|==============================================
-
-
-include::downloadable-packages/8-10-1/prebuilt-rules-8-10-1-summary.asciidoc[leveloffset=+1]
-include::downloadable-packages/8-10-2/prebuilt-rules-8-10-2-summary.asciidoc[leveloffset=+1]
-include::downloadable-packages/8-10-3/prebuilt-rules-8-10-3-summary.asciidoc[leveloffset=+1]
-include::downloadable-packages/8-10-4/prebuilt-rules-8-10-4-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index 1a358b8b8b..5a9461bffc 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -1062,6 +1062,14 @@ and their rule type is `machine_learning`.
 
 |<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
+|<<potential-data-exfiltration-activity-to-an-unusual-destination-port, Potential Data Exfiltration Activity to an Unusual Destination Port>> |A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
+|<<potential-data-exfiltration-activity-to-an-unusual-ip-address, Potential Data Exfiltration Activity to an Unusual IP Address>> |A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
+|<<potential-data-exfiltration-activity-to-an-unusual-iso-code, Potential Data Exfiltration Activity to an Unusual ISO Code>> |A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
+|<<potential-data-exfiltration-activity-to-an-unusual-region, Potential Data Exfiltration Activity to an Unusual Region>> |A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
 |<<potential-defense-evasion-via-cmstp-exe, Potential Defense Evasion via CMSTP.exe>> |The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program to install Connection Manager service profiles, which accept installation information file (INF) files. Adversaries may abuse CMSTP to proxy the execution of malicious code by supplying INF files that contain malicious commands. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
 |<<potential-defense-evasion-via-proot, Potential Defense Evasion via PRoot>> |Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |3
@@ -1492,6 +1500,10 @@ and their rule type is `machine_learning`.
 
 |<<spike-in-aws-error-messages, Spike in AWS Error Messages>> |A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.3.0 |107
 
+|<<spike-in-bytes-sent-to-an-external-device, Spike in Bytes Sent to an External Device>> |A machine learning job has detected high bytes of data written to an external device. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
+|<<spike-in-bytes-sent-to-an-external-device-via-airdrop, Spike in Bytes Sent to an External Device via Airdrop>> |A machine learning job has detected high bytes of data written to an external device via Airdrop. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
 |<<spike-in-failed-logon-events, Spike in Failed Logon Events>> |A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |104
 
 |<<spike-in-firewall-denies, Spike in Firewall Denies>> |A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |103
@@ -1832,6 +1844,8 @@ and their rule type is `machine_learning`.
 
 |<<unusual-process-network-connection, Unusual Process Network Connection>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |106
 
+|<<unusual-process-writing-data-to-an-external-device, Unusual Process Writing Data to an External Device>> |A machine learning job has detected a rare process writing data to an external device. Malicious actors often use benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no legitimate reason to write data to external devices can indicate exfiltration. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |1
+
 |<<unusual-remote-file-directory, Unusual Remote File Directory>> |An anomaly detection job has detected a remote file transfer on an unusual directory indicating a potential lateral movement activity on the host. Many Security solutions monitor well-known directories for suspicious activities, so attackers might use less common directories to bypass monitoring. |[Use Case: Lateral Movement Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Lateral Movement] |8.9.0 |1
 
 |<<unusual-remote-file-extension, Unusual Remote File Extension>> |An anomaly detection job has detected a remote file transfer with a rare extension, which could indicate potential lateral movement activity on the host. |[Use Case: Lateral Movement Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Lateral Movement] |8.9.0 |1
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 3b4c7b0b3d..b9114dde10 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -522,6 +522,10 @@ include::rule-details/potential-cross-site-scripting-xss.asciidoc[]
 include::rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
 include::rule-details/potential-dll-sideloading-via-trusted-microsoft-programs.asciidoc[]
 include::rule-details/potential-dns-tunneling-via-nslookup.asciidoc[]
+include::rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc[]
+include::rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc[]
+include::rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc[]
+include::rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc[]
 include::rule-details/potential-defense-evasion-via-cmstp-exe.asciidoc[]
 include::rule-details/potential-defense-evasion-via-proot.asciidoc[]
 include::rule-details/potential-disabling-of-apparmor.asciidoc[]
@@ -737,6 +741,8 @@ include::rule-details/signed-proxy-execution-via-ms-work-folders.asciidoc[]
 include::rule-details/softwareupdate-preferences-modification.asciidoc[]
 include::rule-details/solarwinds-process-disabling-services-via-registry.asciidoc[]
 include::rule-details/spike-in-aws-error-messages.asciidoc[]
+include::rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc[]
+include::rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc[]
 include::rule-details/spike-in-failed-logon-events.asciidoc[]
 include::rule-details/spike-in-firewall-denies.asciidoc[]
 include::rule-details/spike-in-logon-events.asciidoc[]
@@ -907,6 +913,7 @@ include::rule-details/unusual-process-for-mssql-service-accounts.asciidoc[]
 include::rule-details/unusual-process-for-a-linux-host.asciidoc[]
 include::rule-details/unusual-process-for-a-windows-host.asciidoc[]
 include::rule-details/unusual-process-network-connection.asciidoc[]
+include::rule-details/unusual-process-writing-data-to-an-external-device.asciidoc[]
 include::rule-details/unusual-remote-file-directory.asciidoc[]
 include::rule-details/unusual-remote-file-extension.asciidoc[]
 include::rule-details/unusual-remote-file-size.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 28e8237bfc..1879a6fc1a 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -59,7 +59,7 @@ Attackers can use this attribute to conceal tooling and malware to prevent admin
 This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index 83a90818c6..c1430478bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -57,7 +57,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 5132d58f73..523c717875 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index 95462ceaba..8c469ccbbf 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index 017c9c8f1e..f0e4f583fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -59,7 +59,7 @@ For more information about the UAC and how it works, check the [official Microso
 During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index 42482b5b4b..43830021d5 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining the security of the system. However
 This rule identifies commands that can disable the Driver Signature Enforcement feature.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index 671538a7fc..2d6c9ef38c 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies registry modifications that can disable DSE.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index 7346f6e552..6a5670a1ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index bf4ecf6618..2b45192302 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -53,7 +53,7 @@ Adversaries may use an existing, legitimate external Web service as a means for
 This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
index 6ae044e4b6..1319bb6823 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -50,7 +50,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -58,26 +58,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
index afaadcecb9..4086155677 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
index a628b12c45..6cc0717bdf 100644
--- a/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,13 +64,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 Elastic Defend integration does not collect environment variable logging by default.
 In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
@@ -84,7 +84,7 @@ In order to capture this behavior, this rule requires a specific configuration o
 - Click Save.
 After saving the integration change, the Elastic Agents running this policy will be updated and
 the rule will function properly.
-For more information on capturing environment variables refer the {security-guide}/security/current/environment-variable-capture.html[helper guide].
+For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index c1474f52dc..aeccb46039 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -53,7 +53,7 @@ Identifies unexpected processes making network connections over port 445. Window
 This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index d23a76b804..dbe701a659 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -54,7 +54,7 @@ After successfully compromising an environment, attackers may try to gain situat
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index 01fa37f73e..8a4b380341 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -56,7 +56,7 @@ Identifies process execution from suspicious default Windows directories. This m
 This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
index 458898c20c..ea7cc484b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
index b7f2a673a1..8f5e70e77b 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -54,7 +54,7 @@ An adversary equipped with compromised credentials may attempt to access the sec
 
 AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
 
-This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a {security-guide}/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a [New Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index 3d4c83ac79..37b1d7b6e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -59,7 +59,7 @@ Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elast
 This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 771ac144c8..17fd45bb56 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -55,7 +55,7 @@ Kerberos is the default authentication protocol in Active Directory, designed to
 Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index ce50fecffb..1baa625ddf 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new groups to maintain access to victim systems or escalate
 This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
index 19025309b9..990859ecff 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -123,7 +123,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -131,13 +131,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
 #### To confirm that Session View data is enabled:
@@ -147,7 +147,7 @@ Session View uses process data collected by the Elastic Defend integration, but
 - If you want to include file and network alerts in Session View, check the boxes for Network and File events.
 - If you want to enable terminal output capture, turn on the Capture terminal output toggle.
 For more information about the additional fields collected when this setting is enabled and
-the usage of Session View for Analysis refer to the {security-guide}/security/current/session-view.html[helper guide].
+the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index 74c304ca28..7a275e8f17 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new accounts (both local and domain) to maintain access to
 This rule identifies the usage of `useradd` and `adduser` to create new accounts.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index b0835b2f44..81faecb475 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -57,8 +57,8 @@ Attackers may add users to a privileged group in order to escalate privileges or
 This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index fe40f738be..0451872b3f 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -60,7 +60,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index 42cbaf200c..61a193d331 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -61,7 +61,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 544bcb3e84..5b525f37ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -60,7 +60,7 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index ba3355465e..af2e186a5b 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -57,7 +57,7 @@ The Microsoft Build Engine, also known as MSBuild, is a platform for building ap
 This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index 0d5d64e098..d2618b9388 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index cc8e22f9b3..4bdddd4d1c 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -59,7 +59,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index d64e8b7f51..22f52d8b7b 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -58,7 +58,7 @@ Attackers can abuse `certutil.exe` to download malware, offensive security tools
 This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index 79e0f98665..cd340a5b30 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -59,7 +59,7 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index da11bf5c78..349a8801cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index 12168d0cfc..382f3d8605 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries (such as process trees, com
 This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index cb64a87aa8..19b91f248d 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -60,8 +60,8 @@ Attackers can leverage systemd timers to run scripts, commands, or malicious sof
 This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
index 28a8c539c1..747bc1d224 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index e89d6185b5..f2fde383f7 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -60,7 +60,7 @@ Windows Update Orchestrator Service is a DCOM service used by other components t
 This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index ba8979dc45..f6ae58d156 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -57,7 +57,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
index c1312f83e1..cd9b3bf642 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -58,7 +58,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 801b797ec8..042fad374a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -57,7 +57,7 @@ Adversaries can abuse MSBuild to proxy the execution of malicious code. The inli
 This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
new file mode 100644
index 0000000000..dcc45c26c8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-destination-port.asciidoc
@@ -0,0 +1,58 @@
+[[potential-data-exfiltration-activity-to-an-unusual-destination-port]]
+=== Potential Data Exfiltration Activity to an Unusual Destination Port
+
+A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-6h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over C2 Channel
+** ID: T1041
+** Reference URL: https://attack.mitre.org/techniques/T1041/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
new file mode 100644
index 0000000000..cb25cec05d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-ip-address.asciidoc
@@ -0,0 +1,58 @@
+[[potential-data-exfiltration-activity-to-an-unusual-ip-address]]
+=== Potential Data Exfiltration Activity to an Unusual IP Address
+
+A machine learning job has detected data exfiltration to a particular geo-location (by IP address). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-6h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over C2 Channel
+** ID: T1041
+** Reference URL: https://attack.mitre.org/techniques/T1041/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
new file mode 100644
index 0000000000..891bb3006f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-iso-code.asciidoc
@@ -0,0 +1,58 @@
+[[potential-data-exfiltration-activity-to-an-unusual-iso-code]]
+=== Potential Data Exfiltration Activity to an Unusual ISO Code
+
+A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-6h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over C2 Channel
+** ID: T1041
+** Reference URL: https://attack.mitre.org/techniques/T1041/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
new file mode 100644
index 0000000000..aac0aa8fff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-data-exfiltration-activity-to-an-unusual-region.asciidoc
@@ -0,0 +1,58 @@
+[[potential-data-exfiltration-activity-to-an-unusual-region]]
+=== Potential Data Exfiltration Activity to an Unusual Region
+
+A machine learning job has detected data exfiltration to a particular geo-location (by region name). Data transfers to geo-locations that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-6h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over C2 Channel
+** ID: T1041
+** Reference URL: https://attack.mitre.org/techniques/T1041/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index 68293a225f..f68e8b6c98 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -59,7 +59,7 @@ Attackers may try to unload minifilters to avoid protections such as malware det
 This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index fb11b2fdf8..3753095189 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -57,8 +57,8 @@ Attackers may create new accounts with a UID of 0 to maintain root access to tar
 This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 9aa9239d86..0bbd6b8335 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -61,7 +61,7 @@ More details can be found [here](https://attack.mitre.org/techniques/T1546/008/)
 This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
index e978e8d829..3831486ba5 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index 3aa6e2cec6..82d9f6f5a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -61,8 +61,8 @@ Attackers can abuse files within the `/etc/init.d/` directory to run scripts, co
 This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 #### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index 2211e84101..a2ca9ed02e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index d6d6d0a5f6..a704a6ab30 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -61,8 +61,8 @@ There might still be users that use `rc.local` in a benign matter, so investigat
 Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index 7a97fd8ae0..111400c6b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -58,7 +58,7 @@ InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (
 This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
index 127a4da297..9a89dca4c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
@@ -55,7 +55,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -63,26 +63,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index 5d170dad0d..c54738b0f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -60,8 +60,8 @@ Adversaries may backdoor web servers with web shells to establish persistent acc
 This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
index c15b239d8e..0a79a07761 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
index fcbf25a5aa..1eae9ee9af 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index 85d679df88..0bfff080fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -59,7 +59,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index 3a6f95e641..c5aedfe2c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -61,7 +61,7 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index f7278b693f..298ab3fdb9 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -54,7 +54,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index 58cf4233a4..1e47d4ca64 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -61,7 +61,7 @@ A named pipe is a type of inter-process communication (IPC) mechanism used in op
 Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index c9f4e3eae9..791ebfe4fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index 0d143a419c..b3935bc7bd 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -57,7 +57,7 @@ CHM (Compiled HTML) files are a format for delivering online help files on Windo
 When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index 10b7cbe10e..b55d7ff46d 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -53,7 +53,7 @@ Identifies a process termination event quickly followed by the deletion of its e
 This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index c60b28595f..8a8cfc24b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -59,7 +59,7 @@ Attackers who add those DLLs to the registry locations can execute code with ele
 This rule identifies modifications on the AppInit registry keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index 26032562ee..e6a7299314 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -57,7 +57,7 @@ Identifies the execution of a file that was created by the virtual system proces
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index 1100bc21bb..e26a779d1d 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index 2cb64b4d52..95ff9987fb 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index 3f6edcbe34..78e33abb19 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -60,7 +60,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 4259fd619b..1c137c58fa 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -55,7 +55,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index 9d8f1efed3..a6d4c722d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index 09b5ab4074..d3f55c6959 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -57,7 +57,7 @@ The Service Control Manager Remote Protocol is a client/server protocol used for
 This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index d12bfcddae..7fc4ddd5c9 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -59,7 +59,7 @@ AutoIt is a scripting language and tool for automating tasks on Microsoft Window
 This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index c9458514d2..49720e5e84 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -55,7 +55,7 @@ Identifies the execution of a process with a single character process name, diff
 Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 46a1112672..6e3817b452 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -58,7 +58,7 @@ Windows services are background processes that run with SYSTEM privileges and pr
 The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
new file mode 100644
index 0000000000..bee5e7f09f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device-via-airdrop.asciidoc
@@ -0,0 +1,58 @@
+[[spike-in-bytes-sent-to-an-external-device-via-airdrop]]
+=== Spike in Bytes Sent to an External Device via Airdrop
+
+A machine learning job has detected high bytes of data written to an external device via Airdrop. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Other Network Medium
+** ID: T1011
+** Reference URL: https://attack.mitre.org/techniques/T1011/
diff --git a/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
new file mode 100644
index 0000000000..92691dd128
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/spike-in-bytes-sent-to-an-external-device.asciidoc
@@ -0,0 +1,58 @@
+[[spike-in-bytes-sent-to-an-external-device]]
+=== Spike in Bytes Sent to an External Device
+
+A machine learning job has detected high bytes of data written to an external device. In a typical operational setting, there is usually a predictable pattern or a certain range of data that is written to external devices. An unusually large amount of data being written is anomalous and can signal illicit data copying or transfer activities.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Physical Medium
+** ID: T1052
+** Reference URL: https://attack.mitre.org/techniques/T1052/
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index 67dca6e88e..952dad97b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -53,7 +53,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index 3188bce51c..08c9874ce3 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -52,7 +52,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index 4c819467c6..ac021771d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -59,7 +59,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index 0584e66168..d80016736e 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -57,7 +57,7 @@ More details on SUNBURST can be found on the [Mandiant Report](https://www.mandi
 This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index b93883517d..0229d557e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -59,7 +59,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 996fe2b255..8c2af43abe 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -63,7 +63,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index e422ed0581..19179c44d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -56,7 +56,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index 9ba95212ed..42bfab5ad1 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -56,7 +56,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index a8bf98aa93..b8ee507b33 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -60,7 +60,7 @@ Print Spooler is a Windows service enabled by default in all Windows clients and
 The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index fb237482da..25043c8501 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -59,7 +59,7 @@ More context and technical details can be found in this [research blog](https://
 This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index 7329f4d48c..f69e50bd95 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index 16522d71cf..e35d92a8d9 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -54,7 +54,7 @@ Attackers may create new services to execute system shells and other command exe
 This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 #### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index 8bb5a2e14f..4e8a018a8f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -53,7 +53,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index 3f1ba26333..f0ffb8f1b2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 26bf945281..89068460d0 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -57,7 +57,7 @@ The Service Host process (SvcHost) is a system process that can host one, or mul
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
index b06ba5ee6e..91b9043ddc 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
@@ -54,7 +54,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
+- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -62,26 +62,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
+For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
+For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
-- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
-- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
-- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
+- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
+- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
+- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
+- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index 5e14d76abc..db92a5ff01 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -57,7 +57,7 @@ Attackers may configure existing services or create new ones to execute system s
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index c5b13148da..8bfe4eb5e9 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -103,9 +103,9 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index d8bd125cbb..57649b2f0f 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -105,9 +105,9 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index 2cc4094a0d..92cb7174ef 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -108,9 +108,9 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index e2731aca54..9fc497b520 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -98,9 +98,9 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
 
-More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
+More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index f0b2f566ea..8a1688c98e 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -61,7 +61,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index a13326f6d8..3c2a670379 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -61,7 +61,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 1853a0b28b..a86180a69c 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -58,7 +58,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index 8d66514698..b72bd2074e 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -57,7 +57,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index d7c0d165b0..5b43393e9a 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -57,7 +57,7 @@ The regular data stream, also referred to as the unnamed data stream since the n
 Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 045832505b..24cfe1f6e5 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -55,7 +55,7 @@ Attackers can abuse certain trusted developer utilities to proxy the execution o
 This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index 1abf8593f4..c246b4cd99 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -60,7 +60,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 1b251b68e7..34abeeac97 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc
new file mode 100644
index 0000000000..761099cb7c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-writing-data-to-an-external-device.asciidoc
@@ -0,0 +1,58 @@
+[[unusual-process-writing-data-to-an-external-device]]
+=== Unusual Process Writing Data to an External Device
+
+A machine learning job has detected a rare process writing data to an external device. Malicious actors often use benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no legitimate reason to write data to external devices can indicate exfiltration.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-2h ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/ded
+
+*Tags*: 
+
+* Use Case: Data Exfiltration Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Exfiltration
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+[source, markdown]
+----------------------------------
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Physical Medium
+** ID: T1052
+** Reference URL: https://attack.mitre.org/techniques/T1052/
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index c3549a83a3..730b2c5360 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -61,7 +61,7 @@ Netsh is a Windows command line tool used for network configuration and troubles
 This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
 
 > **Note**:
-> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index 8045ca2530..3de8ba9049 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -91,3 +91,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-10-2/prebuilt-rules-8
 include::detections/prebuilt-rules/downloadable-packages/8-10-3/prebuilt-rules-8-10-3-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-10-4/prebuilt-rules-8-10-4-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rules-8-11-1-appendix.asciidoc[]

From 26e6f4ecf4e7dcaec556559cd4f959d0f860f756 Mon Sep 17 00:00:00 2001
From: terrancedejesus <terrance.dejesus@elastic.co>
Date: Sat, 14 Oct 2023 17:49:14 -0400
Subject: [PATCH 2/3] fixed broken links

---
 ...es-and-directories-via-commandline.asciidoc | 18 +++++++++---------
 ...ation-of-hidden-shared-object-file.asciidoc | 18 +++++++++---------
 ...ia-ld-preload-environment-variable.asciidoc | 10 +++++-----
 ...privileged-local-groups-membership.asciidoc |  2 +-
 ...11-1-file-made-immutable-by-chattr.asciidoc | 18 +++++++++---------
 ...-shell-breakout-via-linux-binary-s.asciidoc | 10 +++++-----
 ...ild-engine-using-an-alternate-name.asciidoc |  2 +-
 ...cript-or-desktop-file-modification.asciidoc | 18 +++++++++---------
 ...-openssh-backdoor-logging-activity.asciidoc | 18 +++++++++---------
 ...l-protocol-tunneling-via-earthworm.asciidoc | 18 +++++++++---------
 ...ux-ftp-brute-force-attack-detected.asciidoc |  8 ++++----
 ...ux-rdp-brute-force-attack-detected.asciidoc |  8 ++++----
 ...8-11-1-powershell-psreflect-script.asciidoc |  2 +-
 ...ous-payload-encoded-and-compressed.asciidoc |  2 +-
 ...t-rule-8-11-1-svchost-spawning-cmd.asciidoc |  2 +-
 ...le-8-11-1-system-log-file-deletion.asciidoc | 18 +++++++++---------
 ...g-hidden-file-attribute-via-attrib.asciidoc |  2 +-
 .../adobe-hijack-persistence.asciidoc          |  2 +-
 ...s-process-for-a-windows-population.asciidoc |  2 +-
 ...anomalous-windows-process-creation.asciidoc |  2 +-
 .../bypass-uac-via-event-viewer.asciidoc       |  2 +-
 ...odification-through-built-in-tools.asciidoc |  2 +-
 ...licy-modification-through-registry.asciidoc |  2 +-
 .../command-prompt-network-connection.asciidoc |  2 +-
 ...on-to-commonly-abused-web-services.asciidoc |  2 +-
 ...es-and-directories-via-commandline.asciidoc | 18 +++++++++---------
 ...ation-of-hidden-shared-object-file.asciidoc | 18 +++++++++---------
 ...ia-ld-preload-environment-variable.asciidoc | 10 +++++-----
 .../direct-outbound-smb-connection.asciidoc    |  2 +-
 ...privileged-local-groups-membership.asciidoc |  2 +-
 ...rom-unusual-directory-command-line.asciidoc |  2 +-
 .../file-made-immutable-by-chattr.asciidoc     | 18 +++++++++---------
 ...-value-accessed-in-secrets-manager.asciidoc |  2 +-
 .../first-time-seen-driver-loaded.asciidoc     |  2 +-
 ...beros-traffic-from-unusual-process.asciidoc |  2 +-
 .../rule-details/linux-group-creation.asciidoc |  4 ++--
 ...-shell-breakout-via-linux-binary-s.asciidoc | 10 +++++-----
 .../linux-user-account-creation.asciidoc       |  4 ++--
 ...nux-user-added-to-privileged-group.asciidoc |  4 ++--
 .../lsass-memory-dump-creation.asciidoc        |  2 +-
 .../lsass-memory-dump-handle-access.asciidoc   |  2 +-
 ...ild-engine-using-an-alternate-name.asciidoc |  2 +-
 ...msbuild-making-network-connections.asciidoc |  2 +-
 ...-failure-followed-by-logon-success.asciidoc |  2 +-
 ...ilure-from-the-same-source-address.asciidoc |  2 +-
 .../network-connection-via-certutil.asciidoc   |  2 +-
 ...-connection-via-compiled-html-file.asciidoc |  2 +-
 ...onnection-via-registration-utility.asciidoc |  2 +-
 ...twork-connection-via-signed-binary.asciidoc |  2 +-
 .../new-systemd-timer-created.asciidoc         |  4 ++--
 ...cript-or-desktop-file-modification.asciidoc | 18 +++++++++---------
 ...update-orchestrator-service-hijack.asciidoc |  2 +-
 ...t-scripts-in-the-startup-directory.asciidoc |  2 +-
 ...an-interface-bypass-via-powershell.asciidoc |  2 +-
 ...cess-via-trusted-developer-utility.asciidoc |  2 +-
 ...tential-evasion-via-filter-manager.asciidoc |  2 +-
 ...nux-backdoor-user-account-creation.asciidoc |  4 ++--
 ...fication-of-accessibility-binaries.asciidoc |  2 +-
 ...-openssh-backdoor-logging-activity.asciidoc | 18 +++++++++---------
 ...ersistence-through-init-d-detected.asciidoc |  4 ++--
 ...hrough-motd-file-creation-detected.asciidoc |  4 ++--
 ...tence-through-run-control-detected.asciidoc |  4 ++--
 ...calation-via-installerfiletakeover.asciidoc |  2 +-
 ...l-protocol-tunneling-via-earthworm.asciidoc | 18 +++++++++---------
 ...mote-code-execution-via-web-server.asciidoc |  4 ++--
 ...ux-ftp-brute-force-attack-detected.asciidoc |  8 ++++----
 ...ux-rdp-brute-force-attack-detected.asciidoc |  8 ++++----
 ...windows-error-manager-masquerading.asciidoc |  2 +-
 .../powershell-psreflect-script.asciidoc       |  2 +-
 ...ous-payload-encoded-and-compressed.asciidoc |  2 +-
 ...ation-via-named-pipe-impersonation.asciidoc |  2 +-
 .../privileged-account-brute-force.asciidoc    |  2 +-
 ...ss-activity-via-compiled-html-file.asciidoc |  2 +-
 ...s-termination-followed-by-deletion.asciidoc |  2 +-
 ...gistry-persistence-via-appinit-dll.asciidoc |  2 +-
 .../remote-execution-via-file-shares.asciidoc  |  2 +-
 .../remote-file-copy-via-teamviewer.asciidoc   |  2 +-
 ...load-via-desktopimgdownldr-utility.asciidoc |  2 +-
 .../remote-file-download-via-mpcmdrun.asciidoc |  2 +-
 ...emote-file-download-via-powershell.asciidoc |  2 +-
 ...le-download-via-script-interpreter.asciidoc |  2 +-
 .../remotely-started-services-via-rpc.asciidoc |  2 +-
 ...renamed-autoit-scripts-interpreter.asciidoc |  2 +-
 ...y-executed-with-short-program-name.asciidoc |  2 +-
 ...rol-spawned-via-script-interpreter.asciidoc |  2 +-
 ...r-persistence-via-unsigned-process.asciidoc |  2 +-
 ...p-or-run-key-registry-modification.asciidoc |  2 +-
 ...ersistence-by-a-suspicious-process.asciidoc |  2 +-
 ...burst-command-and-control-activity.asciidoc |  2 +-
 ...ous-antimalware-scan-interface-dll.asciidoc |  2 +-
 .../suspicious-certutil-commands.asciidoc      |  2 +-
 ...ious-net-reflection-via-powershell.asciidoc |  2 +-
 ...table-encoded-in-powershell-script.asciidoc |  2 +-
 ...ous-print-spooler-spl-file-created.asciidoc |  2 +-
 ...cess-access-via-direct-system-call.asciidoc |  2 +-
 ...process-spawned-from-motd-detected.asciidoc |  4 ++--
 ...ervice-was-installed-in-the-system.asciidoc |  2 +-
 ...-startup-shell-folder-modification.asciidoc |  2 +-
 .../suspicious-zoom-child-process.asciidoc     |  2 +-
 .../rule-details/svchost-spawning-cmd.asciidoc |  2 +-
 .../system-log-file-deletion.asciidoc          | 18 +++++++++---------
 .../system-shells-via-services.asciidoc        |  2 +-
 .../threat-intel-hash-indicator-match.asciidoc |  6 +++---
 ...t-intel-ip-address-indicator-match.asciidoc |  6 +++---
 .../threat-intel-url-indicator-match.asciidoc  |  6 +++---
 ...l-windows-registry-indicator-match.asciidoc |  6 +++---
 ...via-windows-directory-masquerading.asciidoc |  2 +-
 ...ia-windows-firewall-snap-in-hijack.asciidoc |  2 +-
 .../untrusted-driver-loaded.asciidoc           |  2 +-
 ...ation-by-a-system-critical-process.asciidoc |  2 +-
 ...ile-creation-alternate-data-stream.asciidoc |  2 +-
 ...ivity-from-a-windows-system-binary.asciidoc |  2 +-
 .../unusual-parent-child-relationship.asciidoc |  2 +-
 ...unusual-process-for-a-windows-host.asciidoc |  2 +-
 ...ential-dumping-using-netsh-command.asciidoc |  2 +-
 115 files changed, 273 insertions(+), 273 deletions(-)

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
index 9e563c285e..25b7da5c6c 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -50,7 +50,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -58,26 +58,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
index 3895772607..7732441610 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-creation-of-hidden-shared-object-file.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
index aeb072b763..e3f727102b 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,13 +64,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 Elastic Defend integration does not collect environment variable logging by default.
 In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
@@ -84,7 +84,7 @@ In order to capture this behavior, this rule requires a specific configuration o
 - Click Save.
 After saving the integration change, the Elastic Agents running this policy will be updated and
 the rule will function properly.
-For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html).
+For more information on capturing environment variables refer the {security-guide}/security/current/environment-variable-capture.html[helper guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
index e2ceea8cc7..1b5c71dc76 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-enumeration-of-privileged-local-groups-membership.asciidoc
@@ -54,7 +54,7 @@ After successfully compromising an environment, attackers may try to gain situat
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
index 2555ae3731..a7aef6a5b1 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-file-made-immutable-by-chattr.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
index c78d7358e4..7c15e5c66b 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -123,7 +123,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -131,13 +131,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
 #### To confirm that Session View data is enabled:
@@ -147,7 +147,7 @@ Session View uses process data collected by the Elastic Defend integration, but
 - If you want to include file and network alerts in Session View, check the boxes for Network and File events.
 - If you want to enable terminal output capture, turn on the Capture terminal output toggle.
 For more information about the additional fields collected when this setting is enabled and
-the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html).
+the usage of Session View for Analysis refer to the {security-guide}/security/current/session-view.html[helper guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
index 1a3f5a90d3..abe75f91f6 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -60,7 +60,7 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
index 0fbd603ed0..3cf29dc0ba 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
index cdc5bdf1a7..f3de24ce3d 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-openssh-backdoor-logging-activity.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
index 28ac629ccc..e4db8c85bd 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-protocol-tunneling-via-earthworm.asciidoc
@@ -55,7 +55,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -63,26 +63,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
index 8cedc5b6d6..75a785acf4 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
index 3da07cf3fe..d8676c4878 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
index 92bb23916a..117ead342d 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-psreflect-script.asciidoc
@@ -61,7 +61,7 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
index 9b627f1523..8e97fd0dc4 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -54,7 +54,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
index 50004626ba..0b305ccde4 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-svchost-spawning-cmd.asciidoc
@@ -57,7 +57,7 @@ The Service Host process (SvcHost) is a system process that can host one, or mul
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
index 4731f9fe8f..285a91046b 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-11-1/prebuilt-rule-8-11-1-system-log-file-deletion.asciidoc
@@ -54,7 +54,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -62,26 +62,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 1879a6fc1a..28e8237bfc 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -59,7 +59,7 @@ Attackers can use this attribute to conceal tooling and malware to prevent admin
 This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index c1430478bd..83a90818c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -57,7 +57,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
index 523c717875..5132d58f73 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-process-for-a-windows-population.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
index 8c469ccbbf..95462ceaba 100644
--- a/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/anomalous-windows-process-creation.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index f0e4f583fa..017c9c8f1e 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -59,7 +59,7 @@ For more information about the UAC and how it works, check the [official Microso
 During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index 43830021d5..42482b5b4b 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining the security of the system. However
 This rule identifies commands that can disable the Driver Signature Enforcement feature.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index 2d6c9ef38c..671538a7fc 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -59,7 +59,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies registry modifications that can disable DSE.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
index 6a5670a1ff..7346f6e552 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-prompt-network-connection.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 This rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 2b45192302..bf4ecf6618 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -53,7 +53,7 @@ Adversaries may use an existing, legitimate external Web service as a means for
 This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
index 1319bb6823..6ae044e4b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-files-and-directories-via-commandline.asciidoc
@@ -50,7 +50,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -58,26 +58,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
index 4086155677..afaadcecb9 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-hidden-shared-object-file.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
index 6cc0717bdf..a628b12c45 100644
--- a/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/deprecated-potential-process-injection-via-ld-preload-environment-variable.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,13 +64,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 Elastic Defend integration does not collect environment variable logging by default.
 In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the Elastic Defend integration.
@@ -84,7 +84,7 @@ In order to capture this behavior, this rule requires a specific configuration o
 - Click Save.
 After saving the integration change, the Elastic Agents running this policy will be updated and
 the rule will function properly.
-For more information on capturing environment variables refer the [helper guide](https://www.elastic.co/guide/en/security/current/environment-variable-capture.html).
+For more information on capturing environment variables refer the {security-guide}/security/current/environment-variable-capture.html[helper guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
index aeccb46039..c1474f52dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/direct-outbound-smb-connection.asciidoc
@@ -53,7 +53,7 @@ Identifies unexpected processes making network connections over port 445. Window
 This rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index dbe701a659..d23a76b804 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -54,7 +54,7 @@ After successfully compromising an environment, attackers may try to gain situat
 This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index 8a4b380341..01fa37f73e 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -56,7 +56,7 @@ Identifies process execution from suspicious default Windows directories. This m
 This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
index ea7cc484b0..458898c20c 100644
--- a/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/file-made-immutable-by-chattr.asciidoc
@@ -52,7 +52,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -60,26 +60,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
index 8f5e70e77b..b7f2a673a1 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-aws-secret-value-accessed-in-secrets-manager.asciidoc
@@ -54,7 +54,7 @@ An adversary equipped with compromised credentials may attempt to access the sec
 
 AWS Secrets Manager is a service that enables the replacement of hardcoded credentials in code, including passwords, with an API call to Secrets Manager to retrieve the secret programmatically.
 
-This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a [New Terms](https://www.elastic.co/guide/en/security/master/rules-ui-create.html#create-new-terms-rule) rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
+This rule looks for the retrieval of credentials using `GetSecretValue` action in Secrets Manager programmatically. This is a {security-guide}/security/master/rules-ui-create.html#create-new-terms-rule[New Terms] rule indicating this is the first time a specific user identity has successfuly retrieved a secret value from Secrets Manager.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index 37b1d7b6e4..3d4c83ac79 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -59,7 +59,7 @@ Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elast
 This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 17fd45bb56..771ac144c8 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -55,7 +55,7 @@ Kerberos is the default authentication protocol in Active Directory, designed to
 Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index 1baa625ddf..ce50fecffb 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new groups to maintain access to victim systems or escalate
 This rule identifies the usages of `groupadd` and `addgroup` to create new groups.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
index 990859ecff..19025309b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-restricted-shell-breakout-via-linux-binary-s.asciidoc
@@ -123,7 +123,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -131,13 +131,13 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 Session View uses process data collected by the Elastic Defend integration, but this data is not always collected by default. Session View is available on enterprise subscription for versions 8.3 and above.
 #### To confirm that Session View data is enabled:
@@ -147,7 +147,7 @@ Session View uses process data collected by the Elastic Defend integration, but
 - If you want to include file and network alerts in Session View, check the boxes for Network and File events.
 - If you want to enable terminal output capture, turn on the Capture terminal output toggle.
 For more information about the additional fields collected when this setting is enabled and
-the usage of Session View for Analysis refer to the [helper guide](https://www.elastic.co/guide/en/security/current/session-view.html).
+the usage of Session View for Analysis refer to the {security-guide}/security/current/session-view.html[helper guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index 7a275e8f17..74c304ca28 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -54,8 +54,8 @@ Attackers may create new accounts (both local and domain) to maintain access to
 This rule identifies the usage of `useradd` and `adduser` to create new accounts.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
index 81faecb475..b0835b2f44 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-added-to-privileged-group.asciidoc
@@ -57,8 +57,8 @@ Attackers may add users to a privileged group in order to escalate privileges or
 This rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index 0451872b3f..fe40f738be 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -60,7 +60,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
index 61a193d331..42cbaf200c 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-handle-access.asciidoc
@@ -61,7 +61,7 @@ Local Security Authority Server Service (LSASS) is a process in Microsoft Window
 Adversaries may attempt to access credential material stored in LSASS process memory. After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. This is meant to facilitate single sign-on (SSO) ensuring a user isn’t prompted each time resource access is requested. These credential materials can be harvested by an adversary using administrative user or SYSTEM privileges to conduct lateral movement using [alternate authentication material](https://attack.mitre.org/techniques/T1550/).
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 5b525f37ff..544bcb3e84 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -60,7 +60,7 @@ The Microsoft Build Engine is a platform for building applications. This engine,
 This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
index af2e186a5b..ba3355465e 100644
--- a/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/msbuild-making-network-connections.asciidoc
@@ -57,7 +57,7 @@ The Microsoft Build Engine, also known as MSBuild, is a platform for building ap
 This rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
index d2618b9388..0d5d64e098 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-followed-by-logon-success.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address, followed by a successful logon, indicating that an attacker potentially successfully compromised the account.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
index 4bdddd4d1c..cc8e22f9b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/multiple-logon-failure-from-the-same-source-address.asciidoc
@@ -59,7 +59,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
index 22f52d8b7b..d64e8b7f51 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-certutil.asciidoc
@@ -58,7 +58,7 @@ Attackers can abuse `certutil.exe` to download malware, offensive security tools
 This rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
index cd340a5b30..79e0f98665 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-compiled-html-file.asciidoc
@@ -59,7 +59,7 @@ When users double-click CHM files, the HTML Help executable program (`hh.exe`) w
 This rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
index 349a8801cc..da11bf5c78 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-registration-utility.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
index 382f3d8605..12168d0cfc 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-connection-via-signed-binary.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries (such as process trees, com
 This rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
index 19b91f248d..cb64a87aa8 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-systemd-timer-created.asciidoc
@@ -60,8 +60,8 @@ Attackers can leverage systemd timers to run scripts, commands, or malicious sof
 This rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
index 747bc1d224..28a8c539c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-kde-autostart-script-or-desktop-file-modification.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index f2fde383f7..e89d6185b5 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -60,7 +60,7 @@ Windows Update Orchestrator Service is a DCOM service used by other components t
 This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index f6ae58d156..ba8979dc45 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -57,7 +57,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
index cd9b3bf642..c1312f83e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc
@@ -58,7 +58,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 This rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
index 042fad374a..801b797ec8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-trusted-developer-utility.asciidoc
@@ -57,7 +57,7 @@ Adversaries can abuse MSBuild to proxy the execution of malicious code. The inli
 This rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index f68e8b6c98..68293a225f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -59,7 +59,7 @@ Attackers may try to unload minifilters to avoid protections such as malware det
 This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
index 3753095189..fb11b2fdf8 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-linux-backdoor-user-account-creation.asciidoc
@@ -57,8 +57,8 @@ Attackers may create new accounts with a UID of 0 to maintain root access to tar
 This rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 - Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 0bbd6b8335..9aa9239d86 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -61,7 +61,7 @@ More details can be found [here](https://attack.mitre.org/techniques/T1546/008/)
 This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
index 3831486ba5..e978e8d829 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-openssh-backdoor-logging-activity.asciidoc
@@ -56,7 +56,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -64,26 +64,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
index 82d9f6f5a9..3aa6e2cec6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-init-d-detected.asciidoc
@@ -61,8 +61,8 @@ Attackers can abuse files within the `/etc/init.d/` directory to run scripts, co
 This rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 #### Possible Investigation Steps
 
 - Investigate the file that was created or modified.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
index a2ca9ed02e..2211e84101 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-motd-file-creation-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
index a704a6ab30..d6d6d0a5f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-through-run-control-detected.asciidoc
@@ -61,8 +61,8 @@ There might still be users that use `rc.local` in a benign matter, so investigat
 Detection alerts from this rule indicate the creation of a new `/etc/rc.local` file. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index 111400c6b4..7a97fd8ae0 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -58,7 +58,7 @@ InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (
 This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
index 9a89dca4c6..127a4da297 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-protocol-tunneling-via-earthworm.asciidoc
@@ -55,7 +55,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -63,26 +63,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
index c54738b0f6..5d170dad0d 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-code-execution-via-web-server.asciidoc
@@ -60,8 +60,8 @@ Adversaries may backdoor web servers with web shells to establish persistent acc
 This rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
index 0a79a07761..c15b239d8e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-ftp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
index 1eae9ee9af..fcbf25a5aa 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-linux-rdp-brute-force-attack-detected.asciidoc
@@ -48,10 +48,10 @@ Auditbeat is a lightweight shipper that you can install on your servers to audit
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 ### Auditd Manager Integration Setup
 The Auditd Manager Integration receives audit events from the Linux Audit Framework which is a part of the Linux kernel.
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
index 0bfff080fc..85d679df88 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-windows-error-manager-masquerading.asciidoc
@@ -59,7 +59,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index c5aedfe2c8..3a6f95e641 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -61,7 +61,7 @@ Although this is an interesting project for every developer and admin out there,
 Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index 298ab3fdb9..f7278b693f 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -54,7 +54,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index 1e47d4ca64..58cf4233a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -61,7 +61,7 @@ A named pipe is a type of inter-process communication (IPC) mechanism used in op
 Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
index 791ebfe4fa..c9f4e3eae9 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileged-account-brute-force.asciidoc
@@ -56,7 +56,7 @@ Adversaries with no prior knowledge of legitimate credentials within the system
 This rule identifies potential password guessing/brute force activity from a single address against an account that contains the `admin` pattern on its name, which is likely a highly privileged account.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index b3935bc7bd..0d143a419c 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -57,7 +57,7 @@ CHM (Compiled HTML) files are a format for delivering online help files on Windo
 When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
index b55d7ff46d..10b7cbe10e 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-termination-followed-by-deletion.asciidoc
@@ -53,7 +53,7 @@ Identifies a process termination event quickly followed by the deletion of its e
 This rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index 8a8cfc24b1..c60b28595f 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -59,7 +59,7 @@ Attackers who add those DLLs to the registry locations can execute code with ele
 This rule identifies modifications on the AppInit registry keys.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
index e6a7299314..26032562ee 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc
@@ -57,7 +57,7 @@ Identifies the execution of a file that was created by the virtual system proces
 Adversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index e26a779d1d..1100bc21bb 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index 95ff9987fb..2cb64b4d52 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -59,7 +59,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index 78e33abb19..3f6edcbe34 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -60,7 +60,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
index 1c137c58fa..4259fd619b 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-powershell.asciidoc
@@ -55,7 +55,7 @@ Attackers commonly transfer tooling or malware from external systems into a comp
 PowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
index a6d4c722d0..9d8f1efed3 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-script-interpreter.asciidoc
@@ -57,7 +57,7 @@ Attackers commonly use WSH scripts as their initial access method, acting like d
 This rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index d3f55c6959..09b5ab4074 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -57,7 +57,7 @@ The Service Control Manager Remote Protocol is a client/server protocol used for
 This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index 7fc4ddd5c9..d12bfcddae 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -59,7 +59,7 @@ AutoIt is a scripting language and tool for automating tasks on Microsoft Window
 This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index 49720e5e84..c9458514d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -55,7 +55,7 @@ Identifies the execution of a process with a single character process name, diff
 Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 6e3817b452..46a1112672 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -58,7 +58,7 @@ Windows services are background processes that run with SYSTEM privileges and pr
 The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
index 952dad97b0..67dca6e88e 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-folder-persistence-via-unsigned-process.asciidoc
@@ -53,7 +53,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule looks for unsigned processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index 08c9874ce3..3188bce51c 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -52,7 +52,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index ac021771d1..4c819467c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -59,7 +59,7 @@ The Windows Startup folder is a special folder in Windows. Programs added to thi
 This rule monitors for commonly abused processes writing to the Startup folder locations.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index d80016736e..0584e66168 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -57,7 +57,7 @@ More details on SUNBURST can be found on the [Mandiant Report](https://www.mandi
 This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index 0229d557e7..b93883517d 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -59,7 +59,7 @@ The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard
 Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 8c2af43abe..996fe2b255 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -63,7 +63,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index 19179c44d2..e422ed0581 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -56,7 +56,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
index 42bfab5ad1..9ba95212ed 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-portable-executable-encoded-in-powershell-script.asciidoc
@@ -56,7 +56,7 @@ PowerShell is one of the main tools system administrators use for automation, re
 Attackers can abuse PowerShell in-memory capabilities to inject executables into memory without touching the disk, bypassing file-based security protections. These executables are generally base64 encoded.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index b8ee507b33..a8bf98aa93 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -60,7 +60,7 @@ Print Spooler is a Windows service enabled by default in all Windows clients and
 The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
index 25043c8501..fb237482da 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-access-via-direct-system-call.asciidoc
@@ -59,7 +59,7 @@ More context and technical details can be found in this [research blog](https://
 This rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
index f69e50bd95..7329f4d48c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-spawned-from-motd-detected.asciidoc
@@ -59,8 +59,8 @@ Attackers can abuse message-of-the-day (motd) files to run scripts, commands or
 This rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. 
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
-> This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses {security-guide}/security/current/osquery-placeholder-fields.html[placeholder fields] to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.
 
 #### Possible Investigation Steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
index e35d92a8d9..16522d71cf 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-service-was-installed-in-the-system.asciidoc
@@ -54,7 +54,7 @@ Attackers may create new services to execute system shells and other command exe
 This rule looks for suspicious services being created with suspicious traits compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 #### Possible investigation steps
 
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index 4e8a018a8f..8bb5a2e14f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -53,7 +53,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index f0ffb8f1b2..3f1ba26333 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -57,7 +57,7 @@ By examining the specific traits of Windows binaries -- such as process trees, c
 This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 89068460d0..26bf945281 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -57,7 +57,7 @@ The Service Host process (SvcHost) is a system process that can host one, or mul
 This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
index 91b9043ddc..b06ba5ee6e 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-log-file-deletion.asciidoc
@@ -54,7 +54,7 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 
 #### Prerequisite Requirements:
 - Fleet is required for Elastic Defend.
-- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
+- To configure Fleet Server refer to the {security-guide}/fleet/current/fleet-server.html[documentation].
 
 #### The following steps should be executed in order to add the Elastic Defend integration on a Linux System:
 - Go to the Kibana home page and click Add integrations.
@@ -62,26 +62,26 @@ the Elastic Agent to monitor events on your host and send data to the Elastic Se
 - Click Add Elastic Defend.
 - Configure the integration name and optionally add a description.
 - Select the type of environment you want to protect, either Traditional Endpoints or Cloud Workloads.
-- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. [Helper guide](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html).
+- Select a configuration preset. Each preset comes with different default settings for Elastic Agent, you can further customize these later by configuring the Elastic Defend integration policy. {security-guide}/security/current/configure-endpoint-integration-policy.html[Helper guide].
 - We suggest to select "Complete EDR (Endpoint Detection and Response)" as a configuration setting, that provides "All events; all preventions"
 - Enter a name for the agent policy in New agent policy name. If other agent policies already exist, you can click the Existing hosts tab and select an existing policy instead.
-For more details on Elastic Agent configuration settings, refer to the [helper guide](https://www.elastic.co/guide/en/fleet/8.10/agent-policy.html).
+For more details on Elastic Agent configuration settings, refer to the {security-guide}/fleet/8.10/agent-policy.html[helper guide].
 - Click Save and Continue.
 - To complete the integration, select Add Elastic Agent to your hosts and continue to the next section to install the Elastic Agent on your hosts.
-For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
+For more details on Elastic Defend refer to the {security-guide}/security/current/install-endpoint.html[helper guide].
 
 ### Auditbeat Setup
 Auditbeat is a lightweight shipper that you can install on your servers to audit the activities of users and processes on your systems. For example, you can use Auditbeat to collect and centralize audit events from the Linux Audit Framework. You can also use Auditbeat to detect changes to critical files, like binaries and configuration files, and identify potential security policy violations.
 
 #### The following steps should be executed in order to add the Auditbeat for Linux System:
 - Elastic provides repositories available for APT and YUM-based distributions. Note that we provide binary packages, but no source packages.
-- To install the APT and YUM repositories follow the setup instructions in this [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setup-repositories.html).
-- To run Auditbeat on Docker follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-docker.html).
-- To run Auditbeat on Kubernetes follow the setup instructions in the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/running-on-kubernetes.html).
-- For complete Setup and Run Auditbeat information refer to the [helper guide](https://www.elastic.co/guide/en/beats/auditbeat/current/setting-up-and-running.html).
+- To install the APT and YUM repositories follow the setup instructions in this {security-guide}/beats/auditbeat/current/setup-repositories.html[helper guide].
+- To run Auditbeat on Docker follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-docker.html[helper guide].
+- To run Auditbeat on Kubernetes follow the setup instructions in the {security-guide}/beats/auditbeat/current/running-on-kubernetes.html[helper guide].
+- For complete Setup and Run Auditbeat information refer to the {security-guide}/beats/auditbeat/current/setting-up-and-running.html[helper guide].
 
 #### Custom Ingest Pipeline
-For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the [guide](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html).
+For versions <8.2, you need to add a custom ingest pipeline to populate `event.ingested` with @timestamp for non-elastic-agent indexes, like auditbeats/filebeat/winlogbeat etc. For more details to add a custom ingest pipeline refer to the {security-guide}/fleet/current/data-streams-pipeline-tutorial.html[guide].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index db92a5ff01..5e14d76abc 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -57,7 +57,7 @@ Attackers may configure existing services or create new ones to execute system s
 This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
index 8bfe4eb5e9..c5b13148da 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-hash-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -103,9 +103,9 @@ This rule is triggered when a hash indicator from the Threat Intel Filebeat modu
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
index 57649b2f0f..d8bd125cbb 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-ip-address-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -105,9 +105,9 @@ This rule is triggered when an IP address indicator from the Threat Intel Filebe
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
index 92cb7174ef..2cc4094a0d 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-url-indicator-match.asciidoc
@@ -61,7 +61,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -108,9 +108,9 @@ This rule is triggered when a URL indicator from the Threat Intel Filebeat modul
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
index 9fc497b520..e2731aca54 100644
--- a/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/threat-intel-windows-registry-indicator-match.asciidoc
@@ -60,7 +60,7 @@ Matches are based on threat intelligence data that's been ingested during the la
 This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
@@ -98,9 +98,9 @@ This rule is triggered when a Windows registry indicator from the Threat Intel F
 - Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
 - Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
 
-This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).
+This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an {security-guide}/security/current/es-threat-intel-integrations.html#agent-ti-integration[Elastic Agent integration], the {security-guide}/security/current/es-threat-intel-integrations.html#ti-mod-integration[Threat Intel module], or a {security-guide}/security/current/es-threat-intel-integrations.html#custom-ti-integration[custom integration].
 
-More information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).
+More information can be found {security-guide}/security/current/es-threat-intel-integrations.html[here].
 ----------------------------------
 
 ==== Rule query
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 8a1688c98e..f0b2f566ea 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -61,7 +61,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index 3c2a670379..a13326f6d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -61,7 +61,7 @@ For more information about the UAC and how it works, check the [official Microso
 This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index a86180a69c..1853a0b28b 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -58,7 +58,7 @@ This protection is essential for maintaining system security. However, attackers
 This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index b72bd2074e..8d66514698 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -57,7 +57,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index 5b43393e9a..d7c0d165b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -57,7 +57,7 @@ The regular data stream, also referred to as the unnamed data stream since the n
 Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
index 24cfe1f6e5..045832505b 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-network-activity-from-a-windows-system-binary.asciidoc
@@ -55,7 +55,7 @@ Attackers can abuse certain trusted developer utilities to proxy the execution o
 This rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index c246b4cd99..1abf8593f4 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -60,7 +60,7 @@ Windows internal/system processes have some characteristics that can be used to
 This rule uses this information to spot suspicious parent and child processes.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
index 34abeeac97..1b251b68e7 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-for-a-windows-host.asciidoc
@@ -54,7 +54,7 @@ Searching for abnormal Windows processes is a good methodology to find potential
 This rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index 730b2c5360..c3549a83a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -61,7 +61,7 @@ Netsh is a Windows command line tool used for network configuration and troubles
 This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
 
 > **Note**:
-> This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the {security-guide}/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
 
 #### Possible investigation steps
 

From 9f5a04e8cac6eb7d8b4338eca6cb43e2082bfaa3 Mon Sep 17 00:00:00 2001
From: terrancedejesus <terrance.dejesus@elastic.co>
Date: Sat, 14 Oct 2023 17:53:56 -0400
Subject: [PATCH 3/3] updated downloadable updates description

---
 ...ebuilt-rules-downloadable-updates.asciidoc | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 75291fc8c9..7ef0fea3a8 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -1 +1,25 @@
-include::downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc[leveloffset=+1]
+[[prebuilt-rules-downloadable-updates]]
+[role="xpack"]
+== Downloadable rule updates
+
+This section lists all updates to prebuilt detection rules, made available with the *Prebuilt Security Detection Rules* integration in Fleet.
+
+To update your installed rules to the latest versions, follow the instructions in <<update-prebuilt-rules>>.
+
+For previous rule updates, please navigate to the https://www.elastic.co/guide/en/security/8.9/prebuilt-rules-downloadable-updates.html[last version].
+
+[width="100%",options="header"]
+|==============================================
+|Update version |Date | New rules | Updated rules | Notes
+
+
+|<<prebuilt-rule-8-11-1-prebuilt-rules-8-11-1-summary, 8.11.1>> | 14 Oct 2023 | 21 | 56 |
+This release includes new rules for GitHub, Windows and Linux.
+New rules for GitHub include detection for organization wide applications and new repository owners.
+Linux rules include detection for CVE-2023-4911 and CVE-2023-38646 exploitation and reverse shells via background processes.
+Windows rules include detection for suspicious file extensions and user enumeration.
+Additionally, significant rule tuning for Windows PowerShell and Microsoft Build Engine rules has been added for better rule efficacy.
+
+|==============================================
+
+include::downloadable-packages/8-11-1/prebuilt-rules-8-11-1-summary.asciidoc[leveloffset=+1]
\ No newline at end of file