diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc index 2e629d870b..1cabd2374b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-4-3-host-files-system-changes-via-windows-subsystem-for-linux]] === Host Files System Changes via Windows Subsystem for Linux -Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-suspicious-execution-via-windows-subsystem-for-linux.asciidoc index 8316d60a9a..573caf048b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-suspicious-execution-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-suspicious-execution-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-4-3-suspicious-execution-via-windows-subsystem-for-linux]] === Suspicious Execution via Windows Subsystem for Linux -Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rules-8-4-3-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rules-8-4-3-summary.asciidoc index 79420d68fa..2078fe577d 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rules-8-4-3-summary.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rules-8-4-3-summary.asciidoc @@ -41,13 +41,13 @@ This section lists all updates associated with version 8.4.3 of the Fleet integr |<> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | new | 1 -|<> | Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 -|<> | Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc index 66706310b2..04587ac494 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-5-1-host-files-system-changes-via-windows-subsystem-for-linux]] === Host Files System Changes via Windows Subsystem for Linux -Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc index bd95676944..86a591c328 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-5-1-suspicious-execution-via-windows-subsystem-for-linux]] === Suspicious Execution via Windows Subsystem for Linux -Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rules-8-5-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rules-8-5-1-summary.asciidoc index b9ef47b742..0179262110 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rules-8-5-1-summary.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rules-8-5-1-summary.asciidoc @@ -41,13 +41,13 @@ This section lists all updates associated with version 8.5.1 of the Fleet integr |<> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | new | 1 -|<> | Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 -|<> | Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc index 0209649c39..726244e94b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-6-1-host-files-system-changes-via-windows-subsystem-for-linux]] === Host Files System Changes via Windows Subsystem for Linux -Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc index a96a62df92..74bfeda0ac 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rule-8-6-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-6-1-suspicious-execution-via-windows-subsystem-for-linux]] === Suspicious Execution via Windows Subsystem for Linux -Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rules-8-6-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rules-8-6-1-summary.asciidoc index 63df5dba36..c7268b9bde 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rules-8-6-1-summary.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-6-1/prebuilt-rules-8-6-1-summary.asciidoc @@ -41,13 +41,13 @@ This section lists all updates associated with version 8.6.1 of the Fleet integr |<> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | new | 1 -|<> | Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 -|<> | Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc index d1a0c3dc8a..baf7df172c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-host-files-system-changes-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-7-1-host-files-system-changes-via-windows-subsystem-for-linux]] === Host Files System Changes via Windows Subsystem for Linux -Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc index 2e040e0b47..e9b6dea8c8 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rule-8-7-1-suspicious-execution-via-windows-subsystem-for-linux.asciidoc @@ -1,7 +1,7 @@ [[prebuilt-rule-8-7-1-suspicious-execution-via-windows-subsystem-for-linux]] === Suspicious Execution via Windows Subsystem for Linux -Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. +Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. *Rule type*: eql diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rules-8-7-1-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rules-8-7-1-summary.asciidoc index 730de3c48d..b77809dd66 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rules-8-7-1-summary.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-7-1/prebuilt-rules-8-7-1-summary.asciidoc @@ -43,13 +43,13 @@ This section lists all updates associated with version 8.7.1 of the Fleet integr |<> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | new | 1 -|<> | Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects Linux Bash commands from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 -|<> | Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 +|<> | Detects files creation and modification on the host system from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1 |<> | Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | new | 1