From 76b9b11f9a855d2bc12f149cc111e174e1587024 Mon Sep 17 00:00:00 2001
From: protectionsmachine
 <72879786+protectionsmachine@users.noreply.github.com>
Date: Wed, 3 Apr 2024 13:19:47 +0000
Subject: [PATCH 1/2] Update latest docs

---
 ...covery-command-via-system-account.asciidoc | 141 +++++
 ...-hidden-file-attribute-via-attrib.asciidoc | 151 +++++
 ...le-8-12-8-adfind-command-activity.asciidoc | 169 +++++
 ...e-8-12-8-adobe-hijack-persistence.asciidoc | 155 +++++
 ...mpt-to-install-kali-linux-via-wsl.asciidoc |  73 +++
 ...-12-8-bypass-uac-via-event-viewer.asciidoc | 170 ++++++
 ...-clearing-windows-console-history.asciidoc | 149 +++++
 ...-12-8-clearing-windows-event-logs.asciidoc | 143 +++++
 ...dification-through-built-in-tools.asciidoc | 135 ++++
 ...icy-modification-through-registry.asciidoc | 146 +++++
 ...-execution-via-solarwinds-process.asciidoc | 110 ++++
 ...ell-activity-started-via-rundll32.asciidoc | 113 ++++
 ...-component-object-model-hijacking.asciidoc | 269 ++++++++
 ...wned-by-suspicious-parent-process.asciidoc | 170 ++++++
 ...ed-free-ssl-certificate-providers.asciidoc |  89 +++
 ...n-to-commonly-abused-web-services.asciidoc | 284 +++++++++
 ...el-process-with-unusual-arguments.asciidoc |  99 +++
 ...-8-creation-of-a-dns-named-record.asciidoc |  95 +++
 ...on-of-a-hidden-local-user-account.asciidoc | 130 ++++
 ...new-gpo-scheduled-task-or-service.asciidoc |  98 +++
 ...f-domain-backup-dpapi-private-key.asciidoc |  99 +++
 ...-modification-of-root-certificate.asciidoc | 176 ++++++
 ...isition-via-registry-hive-dumping.asciidoc | 148 +++++
 ...te-volume-usn-journal-with-fsutil.asciidoc | 117 ++++
 ...ting-backup-catalogs-with-wbadmin.asciidoc | 140 +++++
 ...ecurity-logs-using-built-in-tools.asciidoc | 155 +++++
 ...-windows-firewall-rules-via-netsh.asciidoc | 132 ++++
 ...control-via-registry-modification.asciidoc | 182 ++++++
 ...-security-settings-via-powershell.asciidoc | 156 +++++
 ...s-over-https-enabled-via-registry.asciidoc |  91 +++
 ...-host-network-discovery-via-netsh.asciidoc | 130 ++++
 ...executable-stored-in-the-registry.asciidoc |  69 +++
 ...ncrypting-files-with-winrar-or-7z.asciidoc | 153 +++++
 ...ing-domain-trusts-via-dsquery-exe.asciidoc | 121 ++++
 ...ting-domain-trusts-via-nltest-exe.asciidoc | 126 ++++
 ...tion-command-spawned-via-wmiprvse.asciidoc | 137 +++++
 ...eration-of-administrator-accounts.asciidoc | 162 +++++
 ...rivileged-local-groups-membership.asciidoc | 195 ++++++
 ...nge-mailbox-export-via-powershell.asciidoc | 130 ++++
 ...creation-with-multiple-extensions.asciidoc |  98 +++
 ...om-unusual-directory-command-line.asciidoc | 267 ++++++++
 ...ecution-of-com-object-via-xwizard.asciidoc |  92 +++
 ...-of-persistent-suspicious-program.asciidoc |  85 +++
 ...ution-via-local-sxs-shared-module.asciidoc |  90 +++
 ...ssql-xp-cmdshell-stored-procedure.asciidoc | 155 +++++
 ...execution-via-tsclient-mountpoint.asciidoc |  84 +++
 ...n-via-windows-subsystem-for-linux.asciidoc |  76 +++
 ...-expired-or-revoked-driver-loaded.asciidoc |  75 +++
 ...g-exchange-mailbox-via-powershell.asciidoc | 160 +++++
 ...used-remote-access-tool-execution.asciidoc | 310 ++++++++++
 ...2-8-first-time-seen-driver-loaded.asciidoc | 153 +++++
 ...-first-time-seen-removable-device.asciidoc |  80 +++
 ...er-mode-dumps-enabled-system-wide.asciidoc |  86 +++
 ...ry-via-microsoft-gpresult-utility.asciidoc | 112 ++++
 ...ocess-and-or-service-terminations.asciidoc | 114 ++++
 ...-8-12-8-iis-http-logging-disabled.asciidoc | 134 ++++
 ...-file-execution-options-injection.asciidoc |  90 +++
 ...windows-update-auto-update-client.asciidoc | 151 +++++
 ...ingress-transfer-via-windows-bits.asciidoc | 170 ++++++
 ...allation-of-custom-shim-databases.asciidoc |  73 +++
 ...tion-of-security-support-provider.asciidoc |  98 +++
 ...eros-traffic-from-unusual-process.asciidoc | 188 ++++++
 ...t-rule-8-12-8-kirbi-file-creation.asciidoc |  65 ++
 ...teral-movement-via-startup-folder.asciidoc | 102 ++++
 ...count-tokenfilter-policy-disabled.asciidoc |  88 +++
 ...2-8-local-scheduled-task-creation.asciidoc |  82 +++
 ...8-12-8-lsass-memory-dump-creation.asciidoc | 172 ++++++
 ...ss-process-access-via-windows-api.asciidoc | 195 ++++++
 ...redicted-to-be-malicious-activity.asciidoc | 134 ++++
 ...-high-malicious-probability-score.asciidoc | 135 ++++
 ...engine-started-an-unusual-process.asciidoc |  92 +++
 ...ngine-started-by-a-script-process.asciidoc | 103 ++++
 ...ngine-started-by-a-system-process.asciidoc |  89 +++
 ...-started-by-an-office-application.asciidoc | 163 +++++
 ...ld-engine-using-an-alternate-name.asciidoc | 158 +++++
 ...-um-spawning-suspicious-processes.asciidoc | 103 ++++
 ...erver-um-writing-suspicious-files.asciidoc | 119 ++++
 ...ker-spawning-suspicious-processes.asciidoc | 102 ++++
 ...iis-connection-strings-decryption.asciidoc |  83 +++
 ...s-service-account-password-dumped.asciidoc |  82 +++
 ...rosoft-windows-defender-tampering.asciidoc | 171 ++++++
 ...mimikatz-memssp-log-file-detected.asciidoc | 138 +++++
 ...cation-of-amsienable-registry-key.asciidoc | 162 +++++
 ...odification-of-boot-configuration.asciidoc | 139 +++++
 ...tion-of-wdigest-security-provider.asciidoc | 152 +++++
 ...ng-hidden-or-webdav-remote-shares.asciidoc | 118 ++++
 ...on-provider-registry-modification.asciidoc | 161 +++++
 ...oweddeviceid-added-via-powershell.asciidoc |  99 +++
 ...-ntds-or-sam-database-file-copied.asciidoc | 168 +++++
 ...sessionpipe-registry-modification.asciidoc |  83 +++
 ...uled-task-activity-via-powershell.asciidoc |  79 +++
 ...-12-8-parent-process-pid-spoofing.asciidoc | 116 ++++
 ...-12-8-peripheral-device-discovery.asciidoc | 124 ++++
 ...tence-via-bits-job-notify-cmdline.asciidoc |  89 +++
 ...tence-via-hidden-run-key-detected.asciidoc | 116 ++++
 ...tence-via-microsoft-office-addins.asciidoc |  91 +++
 ...istence-via-microsoft-outlook-vba.asciidoc |  82 +++
 ...ersistence-via-powershell-profile.asciidoc | 155 +++++
 ...stence-via-scheduled-job-creation.asciidoc |  96 +++
 ...ycontroller-scheduled-task-hijack.asciidoc | 112 ++++
 ...pdate-orchestrator-service-hijack.asciidoc | 180 ++++++
 ...stence-via-wmi-event-subscription.asciidoc |  96 +++
 ...ia-wmi-standard-registry-provider.asciidoc | 201 ++++++
 ...-scripts-in-the-startup-directory.asciidoc | 173 ++++++
 ...2-8-port-forwarding-rule-addition.asciidoc | 148 +++++
 ...ning-via-wildcard-record-creation.asciidoc |  94 +++
 ...-application-shimming-via-sdbinst.asciidoc |  97 +++
 ...tial-access-via-windows-utilities.asciidoc | 181 ++++++
 ...ft-antimalware-service-executable.asciidoc |  95 +++
 ...ng-via-trusted-microsoft-programs.asciidoc |  96 +++
 ...ential-dns-tunneling-via-nslookup.asciidoc | 125 ++++
 ...ential-evasion-via-filter-manager.asciidoc | 148 +++++
 ...on-via-windows-filtering-platform.asciidoc | 134 ++++
 ...otential-execution-via-xzbackdoor.asciidoc |  98 +++
 ...tential-file-transfer-via-certreq.asciidoc | 152 +++++
 ...tential-local-ntlm-relay-via-http.asciidoc |  88 +++
 ...-lsa-authentication-package-abuse.asciidoc |  83 +++
 ...erading-as-business-app-installer.asciidoc | 217 +++++++
 ...asquerading-as-communication-apps.asciidoc | 134 ++++
 ...ication-of-accessibility-binaries.asciidoc | 194 ++++++
 ...ce-via-time-provider-modification.asciidoc | 156 +++++
 ...rint-processor-registration-abuse.asciidoc |  95 +++
 ...hacktool-script-by-function-names.asciidoc | 353 +++++++++++
 ...rshell-pass-the-hash-relay-script.asciidoc | 123 ++++
 ...alation-via-installerfiletakeover.asciidoc | 164 +++++
 ...te-credential-access-via-registry.asciidoc | 146 +++++
 ...remote-desktop-tunneling-detected.asciidoc | 145 +++++
 ...file-deletion-via-sdelete-utility.asciidoc | 124 ++++
 ...-12-8-powershell-psreflect-script.asciidoc | 191 ++++++
 ...ell-script-block-logging-disabled.asciidoc | 135 ++++
 ...ery-related-windows-api-functions.asciidoc | 210 +++++++
 ...us-payload-encoded-and-compressed.asciidoc | 186 ++++++
 ...-clipboard-retrieval-capabilities.asciidoc | 171 ++++++
 ...tion-via-named-pipe-impersonation.asciidoc | 149 +++++
 ...n-via-windir-environment-variable.asciidoc |  77 +++
 ...n-via-parent-process-pid-spoofing.asciidoc | 130 ++++
 ...s-activity-via-compiled-html-file.asciidoc | 168 +++++
 ...s-created-with-a-duplicated-token.asciidoc |  95 +++
 ...ss-created-with-an-elevated-token.asciidoc | 129 ++++
 ...ecution-from-an-unusual-directory.asciidoc | 196 ++++++
 ...gram-files-directory-masquerading.asciidoc |  92 +++
 ...re-smb-connection-to-the-internet.asciidoc | 100 +++
 ...e-8-12-8-rdp-enabled-via-registry.asciidoc | 151 +++++
 ...istry-persistence-via-appcert-dll.asciidoc | 100 +++
 ...istry-persistence-via-appinit-dll.asciidoc | 175 ++++++
 ...bled-in-windows-firewall-by-netsh.asciidoc | 136 +++++
 ...emote-file-copy-to-a-hidden-share.asciidoc |  87 +++
 ...8-remote-file-copy-via-teamviewer.asciidoc | 154 +++++
 ...oad-via-desktopimgdownldr-utility.asciidoc | 155 +++++
 ...remote-file-download-via-mpcmdrun.asciidoc | 154 +++++
 ...remotely-started-services-via-rpc.asciidoc | 169 +++++
 ...enamed-autoit-scripts-interpreter.asciidoc | 148 +++++
 ...-executed-with-short-program-name.asciidoc | 132 ++++
 ...cheduled-tasks-at-command-enabled.asciidoc | 101 +++
 ...ver-spawning-suspicious-processes.asciidoc |  87 +++
 ...or-saved-credentials-via-vaultcmd.asciidoc |  92 +++
 ...ol-spawned-via-script-interpreter.asciidoc | 172 ++++++
 ...-8-12-8-sip-provider-modification.asciidoc |  76 +++
 ...s-disabling-services-via-registry.asciidoc | 113 ++++
 ...-or-run-key-registry-modification.asciidoc | 324 ++++++++++
 ...rsistence-by-a-suspicious-process.asciidoc | 178 ++++++
 ...urst-command-and-control-activity.asciidoc | 157 +++++
 ...picious-access-to-ldap-attributes.asciidoc |  81 +++
 ...us-antimalware-scan-interface-dll.asciidoc | 142 +++++
 ...12-8-suspicious-certutil-commands.asciidoc | 137 +++++
 ...-suspicious-cmd-execution-via-wmi.asciidoc |  88 +++
 ...rsistence-or-privilege-escalation.asciidoc | 191 ++++++
 ...-endpoint-security-parent-process.asciidoc | 107 ++++
 ...s-execution-from-a-mounted-device.asciidoc | 112 ++++
 ...picious-execution-from-inet-cache.asciidoc |  82 +++
 ...tion-via-microsoft-office-add-ins.asciidoc | 123 ++++
 ...ious-execution-via-scheduled-task.asciidoc | 129 ++++
 ...n-via-windows-subsystem-for-linux.asciidoc |  97 +++
 ...suspicious-explorer-child-process.asciidoc | 128 ++++
 ...-load-taskschd-dll-from-ms-office.asciidoc | 182 ++++++
 ...icious-imagepath-service-creation.asciidoc |  81 +++
 ...process-communication-via-outlook.asciidoc |  91 +++
 ...-jetbrains-teamcity-child-process.asciidoc |  98 +++
 ...soft-diagnostics-wizard-execution.asciidoc |  92 +++
 ...suspicious-module-loaded-by-lsass.asciidoc | 147 +++++
 ...uspicious-ms-office-child-process.asciidoc | 192 ++++++
 ...spicious-ms-outlook-child-process.asciidoc | 179 ++++++
 ...8-suspicious-net-code-compilation.asciidoc |  97 +++
 ...ous-net-reflection-via-powershell.asciidoc | 200 ++++++
 ...spicious-pdf-reader-child-process.asciidoc | 166 +++++
 ...cious-powershell-engine-imageload.asciidoc | 137 +++++
 ...cious-print-spooler-file-deletion.asciidoc |  83 +++
 ...print-spooler-point-and-print-dll.asciidoc |  80 +++
 ...us-print-spooler-spl-file-created.asciidoc | 169 +++++
 ...-service-executable-file-creation.asciidoc |  94 +++
 ...ion-via-renamed-psexec-executable.asciidoc | 142 +++++
 ...picious-rdp-activex-client-loaded.asciidoc | 105 ++++
 ...creenconnect-client-child-process.asciidoc |  86 +++
 ...spicious-solarwinds-child-process.asciidoc | 109 ++++
 ...startup-shell-folder-modification.asciidoc | 165 +++++
 ...suspicious-werfault-child-process.asciidoc | 115 ++++
 ...process-cluster-spawned-by-a-host.asciidoc | 124 ++++
 ...uster-spawned-by-a-parent-process.asciidoc | 126 ++++
 ...process-cluster-spawned-by-a-user.asciidoc | 126 ++++
 ...ous-wmi-image-load-from-ms-office.asciidoc |  83 +++
 ...2-8-suspicious-zoom-child-process.asciidoc | 144 +++++
 ...-rule-8-12-8-svchost-spawning-cmd.asciidoc | 143 +++++
 ...bolic-link-to-shadow-copy-created.asciidoc | 172 ++++++
 ...8-12-8-system-shells-via-services.asciidoc | 145 +++++
 ...es-deleted-via-unexpected-process.asciidoc | 164 +++++
 ...nternet-explorer-add-on-installer.asciidoc | 115 ++++
 ...eged-ifileoperation-com-interface.asciidoc | 110 ++++
 ...ia-windows-directory-masquerading.asciidoc | 174 ++++++
 ...ademanager-elevated-com-interface.asciidoc | 113 ++++
 ...diskcleanup-scheduled-task-hijack.asciidoc | 112 ++++
 ...icmluautil-elevated-com-interface.asciidoc | 111 ++++
 ...a-windows-firewall-snap-in-hijack.asciidoc | 177 ++++++
 ...ommon-registry-persistence-change.asciidoc | 142 +++++
 ...-8-unsigned-dll-loaded-by-svchost.asciidoc | 179 ++++++
 ...-loading-from-a-suspicious-folder.asciidoc | 167 +++++
 ...le-8-12-8-untrusted-driver-loaded.asciidoc | 144 +++++
 ...ess-from-a-system-virtual-process.asciidoc |  80 +++
 ...-unusual-child-process-of-dns-exe.asciidoc | 136 +++++
 ...usual-child-processes-of-rundll32.asciidoc | 144 +++++
 ...tion-by-a-system-critical-process.asciidoc | 162 +++++
 ...le-creation-alternate-data-stream.asciidoc | 212 +++++++
 ...sual-file-modification-by-dns-exe.asciidoc | 100 +++
 ...unusual-parent-child-relationship.asciidoc | 179 ++++++
 ...nusual-parent-process-for-cmd-exe.asciidoc | 104 ++++
 ...persistence-via-services-registry.asciidoc |  96 +++
 ...usual-print-spooler-child-process.asciidoc |  93 +++
 ...cution-path-alternate-data-stream.asciidoc |  83 +++
 ...unusual-process-spawned-by-a-host.asciidoc | 126 ++++
 ...ocess-spawned-by-a-parent-process.asciidoc | 126 ++++
 ...unusual-process-spawned-by-a-user.asciidoc | 126 ++++
 ...t-child-process-childless-service.asciidoc | 120 ++++
 ...rule-8-12-8-user-account-creation.asciidoc | 135 ++++
 ...library-loaded-by-unusual-process.asciidoc |  81 +++
 ...y-deleted-or-resized-via-vssadmin.asciidoc | 154 +++++
 ...adow-copy-deletion-via-powershell.asciidoc | 173 ++++++
 ...ume-shadow-copy-deletion-via-wmic.asciidoc | 163 +++++
 ...ess-child-of-common-web-processes.asciidoc | 190 ++++++
 ...le-8-12-8-whoami-process-activity.asciidoc | 152 +++++
 ...isabled-via-registry-modification.asciidoc | 170 ++++++
 ...r-exclusions-added-via-powershell.asciidoc | 167 +++++
 ...-firewall-disabled-via-powershell.asciidoc | 151 +++++
 ...gistry-file-creation-in-smb-share.asciidoc | 138 +++++
 ...ndows-script-executing-powershell.asciidoc | 170 ++++++
 ...-for-linux-distribution-installed.asciidoc | 126 ++++
 ...or-linux-enabled-via-dism-utility.asciidoc | 120 ++++
 ...ntial-dumping-using-netsh-command.asciidoc | 138 +++++
 .../prebuilt-rules-8-12-8-appendix.asciidoc   | 253 ++++++++
 .../prebuilt-rules-8-12-8-summary.asciidoc    | 506 +++++++++++++++
 ...ebuilt-rules-downloadable-updates.asciidoc |   5 +
 .../prebuilt-rules-reference.asciidoc         | 576 +++++++++---------
 .../prebuilt-rules/rule-desc-index.asciidoc   |   9 +-
 ...covery-command-via-system-account.asciidoc |   4 +-
 .../account-password-reset-remotely.asciidoc  |   2 +-
 ...-hidden-file-attribute-via-attrib.asciidoc |   4 +-
 .../adfind-command-activity.asciidoc          |   4 +-
 .../adobe-hijack-persistence.asciidoc         |   4 +-
 ...mpt-to-install-kali-linux-via-wsl.asciidoc |   4 +-
 ...orce-a-microsoft-365-user-account.asciidoc |   2 +-
 .../bypass-uac-via-event-viewer.asciidoc      |   4 +-
 .../clearing-windows-console-history.asciidoc |   4 +-
 .../clearing-windows-event-logs.asciidoc      |   4 +-
 ...dification-through-built-in-tools.asciidoc |   4 +-
 ...icy-modification-through-registry.asciidoc |   4 +-
 ...-execution-via-solarwinds-process.asciidoc |   4 +-
 ...ell-activity-started-via-rundll32.asciidoc |   4 +-
 .../component-object-model-hijacking.asciidoc |   4 +-
 ...wned-by-suspicious-parent-process.asciidoc |   4 +-
 ...ed-free-ssl-certificate-providers.asciidoc |   4 +-
 ...n-to-commonly-abused-web-services.asciidoc |  83 ++-
 ...el-process-with-unusual-arguments.asciidoc |   4 +-
 .../creation-of-a-dns-named-record.asciidoc   |  95 +++
 ...on-of-a-hidden-local-user-account.asciidoc |   4 +-
 ...new-gpo-scheduled-task-or-service.asciidoc |   4 +-
 ...f-domain-backup-dpapi-private-key.asciidoc |   4 +-
 ...-modification-of-root-certificate.asciidoc |   4 +-
 ...isition-via-registry-hive-dumping.asciidoc |   4 +-
 ...te-volume-usn-journal-with-fsutil.asciidoc |   4 +-
 ...ting-backup-catalogs-with-wbadmin.asciidoc |   4 +-
 ...ecurity-logs-using-built-in-tools.asciidoc |   4 +-
 ...-windows-firewall-rules-via-netsh.asciidoc |   4 +-
 ...control-via-registry-modification.asciidoc |   4 +-
 ...-security-settings-via-powershell.asciidoc |   4 +-
 ...s-over-https-enabled-via-registry.asciidoc |   4 +-
 ...-host-network-discovery-via-netsh.asciidoc |   4 +-
 ...executable-stored-in-the-registry.asciidoc |   4 +-
 ...ncrypting-files-with-winrar-or-7z.asciidoc |   4 +-
 ...ing-domain-trusts-via-dsquery-exe.asciidoc |   4 +-
 ...ting-domain-trusts-via-nltest-exe.asciidoc |   4 +-
 ...tion-command-spawned-via-wmiprvse.asciidoc |   4 +-
 ...eration-of-administrator-accounts.asciidoc |   4 +-
 ...rivileged-local-groups-membership.asciidoc |  65 +-
 ...nge-mailbox-export-via-powershell.asciidoc |  11 +-
 ...creation-with-multiple-extensions.asciidoc |   4 +-
 ...om-unusual-directory-command-line.asciidoc |   4 +-
 ...ecution-of-com-object-via-xwizard.asciidoc |   4 +-
 ...-of-persistent-suspicious-program.asciidoc |   4 +-
 ...ution-via-local-sxs-shared-module.asciidoc |   4 +-
 ...ssql-xp-cmdshell-stored-procedure.asciidoc |   4 +-
 ...execution-via-tsclient-mountpoint.asciidoc |   4 +-
 ...n-via-windows-subsystem-for-linux.asciidoc |   4 +-
 .../expired-or-revoked-driver-loaded.asciidoc |   4 +-
 ...g-exchange-mailbox-via-powershell.asciidoc |   4 +-
 ...used-remote-access-tool-execution.asciidoc | 209 ++++++-
 .../first-time-seen-driver-loaded.asciidoc    |   4 +-
 .../first-time-seen-removable-device.asciidoc |   4 +-
 ...er-mode-dumps-enabled-system-wide.asciidoc |   4 +-
 ...ry-via-microsoft-gpresult-utility.asciidoc |   4 +-
 ...ocess-and-or-service-terminations.asciidoc |   4 +-
 .../iis-http-logging-disabled.asciidoc        |   4 +-
 ...-file-execution-options-injection.asciidoc |   4 +-
 ...windows-update-auto-update-client.asciidoc |   4 +-
 ...ingress-transfer-via-windows-bits.asciidoc |   4 +-
 ...allation-of-custom-shim-databases.asciidoc |   4 +-
 ...tion-of-security-support-provider.asciidoc |   4 +-
 ...eros-traffic-from-unusual-process.asciidoc |   4 +-
 .../rule-details/kirbi-file-creation.asciidoc |   4 +-
 ...teral-movement-via-startup-folder.asciidoc |   4 +-
 .../linux-group-creation.asciidoc             |   3 +-
 .../linux-user-account-creation.asciidoc      |   3 +-
 ...count-tokenfilter-policy-disabled.asciidoc |   4 +-
 .../local-scheduled-task-creation.asciidoc    |   4 +-
 .../lsass-memory-dump-creation.asciidoc       |   4 +-
 ...ss-process-access-via-windows-api.asciidoc |   4 +-
 ...redicted-to-be-malicious-activity.asciidoc |   6 +-
 ...-high-malicious-probability-score.asciidoc |   6 +-
 ...change-anti-phish-policy-deletion.asciidoc |   2 +-
 ...ange-anti-phish-rule-modification.asciidoc |   2 +-
 ...im-signing-configuration-disabled.asciidoc |   2 +-
 ...t-365-exchange-dlp-policy-removed.asciidoc |   2 +-
 ...ge-malware-filter-policy-deletion.asciidoc |   2 +-
 ...-malware-filter-rule-modification.asciidoc |   2 +-
 ...-management-group-role-assignment.asciidoc |   2 +-
 ...nge-safe-attachment-rule-disabled.asciidoc |   2 +-
 ...xchange-safe-link-policy-disabled.asciidoc |   2 +-
 ...-exchange-transport-rule-creation.asciidoc |   2 +-
 ...hange-transport-rule-modification.asciidoc |   2 +-
 ...lobal-administrator-role-assigned.asciidoc |   2 +-
 ...365-inbox-forwarding-rule-created.asciidoc |   2 +-
 ...365-potential-ransomware-activity.asciidoc |   2 +-
 ...m-application-interaction-allowed.asciidoc |   2 +-
 ...365-teams-external-access-enabled.asciidoc |   2 +-
 ...ft-365-teams-guest-access-enabled.asciidoc |   2 +-
 ...5-unusual-volume-of-file-deletion.asciidoc |   2 +-
 ...ser-restricted-from-sending-email.asciidoc |   2 +-
 ...engine-started-an-unusual-process.asciidoc |   4 +-
 ...ngine-started-by-a-script-process.asciidoc |   4 +-
 ...ngine-started-by-a-system-process.asciidoc |   4 +-
 ...-started-by-an-office-application.asciidoc |   4 +-
 ...ld-engine-using-an-alternate-name.asciidoc |   4 +-
 ...-um-spawning-suspicious-processes.asciidoc |   4 +-
 ...erver-um-writing-suspicious-files.asciidoc |   4 +-
 ...ker-spawning-suspicious-processes.asciidoc |   4 +-
 ...iis-connection-strings-decryption.asciidoc |   4 +-
 ...s-service-account-password-dumped.asciidoc |   4 +-
 ...rosoft-windows-defender-tampering.asciidoc |   4 +-
 ...mimikatz-memssp-log-file-detected.asciidoc |   4 +-
 ...cation-of-amsienable-registry-key.asciidoc |   4 +-
 ...odification-of-boot-configuration.asciidoc |   4 +-
 ...tion-of-wdigest-security-provider.asciidoc |   4 +-
 ...ng-hidden-or-webdav-remote-shares.asciidoc |   4 +-
 ...on-provider-registry-modification.asciidoc |   4 +-
 ...oweddeviceid-added-via-powershell.asciidoc |   4 +-
 ...new-or-modified-federation-domain.asciidoc |   2 +-
 .../ntds-or-sam-database-file-copied.asciidoc |   4 +-
 ...sessionpipe-registry-modification.asciidoc |   4 +-
 ...orted-by-user-as-malware-or-phish.asciidoc |   2 +-
 ...ssive-single-sign-on-logon-errors.asciidoc |   2 +-
 ...spicious-mailbox-right-delegation.asciidoc |   2 +-
 ...o365-mailbox-audit-logging-bypass.asciidoc |   2 +-
 .../onedrive-malware-file-upload.asciidoc     |   2 +-
 ...uled-task-activity-via-powershell.asciidoc |   4 +-
 .../parent-process-pid-spoofing.asciidoc      |   4 +-
 .../peripheral-device-discovery.asciidoc      |   4 +-
 ...tence-via-bits-job-notify-cmdline.asciidoc |   4 +-
 ...tence-via-hidden-run-key-detected.asciidoc |   4 +-
 ...tence-via-microsoft-office-addins.asciidoc |   4 +-
 ...istence-via-microsoft-outlook-vba.asciidoc |   4 +-
 ...ersistence-via-powershell-profile.asciidoc |   4 +-
 ...stence-via-scheduled-job-creation.asciidoc |   4 +-
 ...ycontroller-scheduled-task-hijack.asciidoc |   4 +-
 ...pdate-orchestrator-service-hijack.asciidoc |   4 +-
 ...stence-via-wmi-event-subscription.asciidoc |   4 +-
 ...ia-wmi-standard-registry-provider.asciidoc |   4 +-
 ...-scripts-in-the-startup-directory.asciidoc |   4 +-
 .../port-forwarding-rule-addition.asciidoc    |   4 +-
 ...-via-azure-registered-application.asciidoc |   2 +-
 ...ning-via-wildcard-record-creation.asciidoc |  94 +++
 ...-application-shimming-via-sdbinst.asciidoc |   5 +-
 ...tial-access-via-windows-utilities.asciidoc |   4 +-
 ...ft-antimalware-service-executable.asciidoc |   4 +-
 ...ng-via-trusted-microsoft-programs.asciidoc |   4 +-
 ...ential-dns-tunneling-via-nslookup.asciidoc |   4 +-
 ...ential-evasion-via-filter-manager.asciidoc |   4 +-
 ...on-via-windows-filtering-platform.asciidoc |   4 +-
 ...otential-execution-via-xzbackdoor.asciidoc |  98 +++
 ...al-linux-ssh-brute-force-detected.asciidoc |   3 +-
 ...tential-file-transfer-via-certreq.asciidoc |   4 +-
 ...al-linux-ssh-brute-force-detected.asciidoc |   3 +-
 ...tential-local-ntlm-relay-via-http.asciidoc |   4 +-
 ...-lsa-authentication-package-abuse.asciidoc |   4 +-
 ...erading-as-business-app-installer.asciidoc |   4 +-
 ...asquerading-as-communication-apps.asciidoc |   4 +-
 ...ication-of-accessibility-binaries.asciidoc |   4 +-
 ...ng-of-microsoft-365-user-accounts.asciidoc |   2 +-
 ...ce-via-time-provider-modification.asciidoc |   4 +-
 ...rint-processor-registration-abuse.asciidoc |   4 +-
 ...hacktool-script-by-function-names.asciidoc |   9 +-
 ...rshell-pass-the-hash-relay-script.asciidoc | 123 ++++
 ...alation-via-installerfiletakeover.asciidoc |   4 +-
 ...te-credential-access-via-registry.asciidoc |   4 +-
 ...remote-desktop-tunneling-detected.asciidoc |   4 +-
 ...file-deletion-via-sdelete-utility.asciidoc |   4 +-
 ...successful-ssh-brute-force-attack.asciidoc |   3 +-
 .../powershell-psreflect-script.asciidoc      |   5 +-
 ...ell-script-block-logging-disabled.asciidoc |   4 +-
 ...-archive-compression-capabilities.asciidoc |  10 +-
 ...cript-with-discovery-capabilities.asciidoc |  21 +-
 ...cript-with-log-clear-capabilities.asciidoc |   5 +-
 ...-execution-capabilities-via-winrm.asciidoc |   8 +-
 ...ery-related-windows-api-functions.asciidoc |   3 +-
 ...us-payload-encoded-and-compressed.asciidoc |   3 +-
 ...-clipboard-retrieval-capabilities.asciidoc |  11 +-
 ...tion-via-named-pipe-impersonation.asciidoc |   4 +-
 ...n-via-windir-environment-variable.asciidoc |   4 +-
 ...n-via-parent-process-pid-spoofing.asciidoc |   4 +-
 ...s-activity-via-compiled-html-file.asciidoc |   4 +-
 ...s-created-with-a-duplicated-token.asciidoc |   4 +-
 ...ss-created-with-an-elevated-token.asciidoc |   4 +-
 ...ecution-from-an-unusual-directory.asciidoc |   4 +-
 ...gram-files-directory-masquerading.asciidoc |   4 +-
 ...ery-registry-using-built-in-tools.asciidoc |   4 +-
 ...re-smb-connection-to-the-internet.asciidoc |   4 +-
 .../rdp-enabled-via-registry.asciidoc         |   4 +-
 ...istry-persistence-via-appcert-dll.asciidoc |   4 +-
 ...istry-persistence-via-appinit-dll.asciidoc |   4 +-
 ...bled-in-windows-firewall-by-netsh.asciidoc |   4 +-
 ...emote-file-copy-to-a-hidden-share.asciidoc |   4 +-
 .../remote-file-copy-via-teamviewer.asciidoc  |   4 +-
 ...oad-via-desktopimgdownldr-utility.asciidoc |   4 +-
 ...remote-file-download-via-mpcmdrun.asciidoc |   4 +-
 ...remotely-started-services-via-rpc.asciidoc |   4 +-
 ...enamed-autoit-scripts-interpreter.asciidoc |   4 +-
 ...-executed-with-short-program-name.asciidoc |   4 +-
 ...cheduled-tasks-at-command-enabled.asciidoc |   4 +-
 ...ver-spawning-suspicious-processes.asciidoc |  87 +++
 ...or-saved-credentials-via-vaultcmd.asciidoc |   4 +-
 ...ol-spawned-via-script-interpreter.asciidoc |   4 +-
 .../sharepoint-malware-file-upload.asciidoc   |   2 +-
 .../sip-provider-modification.asciidoc        |   4 +-
 ...s-disabling-services-via-registry.asciidoc |   4 +-
 ...-or-run-key-registry-modification.asciidoc |   4 +-
 ...rsistence-by-a-suspicious-process.asciidoc |   4 +-
 ...urst-command-and-control-activity.asciidoc |   4 +-
 ...picious-access-to-ldap-attributes.asciidoc |  81 +++
 ...us-antimalware-scan-interface-dll.asciidoc |   4 +-
 .../suspicious-certutil-commands.asciidoc     |   4 +-
 .../suspicious-cmd-execution-via-wmi.asciidoc |   4 +-
 ...rsistence-or-privilege-escalation.asciidoc |   4 +-
 ...-endpoint-security-parent-process.asciidoc |   4 +-
 ...s-execution-from-a-mounted-device.asciidoc |   4 +-
 ...picious-execution-from-inet-cache.asciidoc |   4 +-
 ...tion-via-microsoft-office-add-ins.asciidoc |   4 +-
 ...ious-execution-via-scheduled-task.asciidoc |   4 +-
 ...n-via-windows-subsystem-for-linux.asciidoc |   4 +-
 ...suspicious-explorer-child-process.asciidoc |   4 +-
 ...-load-taskschd-dll-from-ms-office.asciidoc |   4 +-
 ...icious-imagepath-service-creation.asciidoc |   4 +-
 ...process-communication-via-outlook.asciidoc |   4 +-
 ...-jetbrains-teamcity-child-process.asciidoc |  98 +++
 ...ft-365-mail-access-by-clientappid.asciidoc |   2 +-
 ...soft-diagnostics-wizard-execution.asciidoc |   4 +-
 ...suspicious-module-loaded-by-lsass.asciidoc |   4 +-
 ...uspicious-ms-office-child-process.asciidoc |   4 +-
 ...spicious-ms-outlook-child-process.asciidoc |   4 +-
 .../suspicious-net-code-compilation.asciidoc  |   4 +-
 ...ous-net-reflection-via-powershell.asciidoc |   3 +-
 ...spicious-pdf-reader-child-process.asciidoc |   4 +-
 ...cious-powershell-engine-imageload.asciidoc |  10 +-
 ...cious-print-spooler-file-deletion.asciidoc |   4 +-
 ...print-spooler-point-and-print-dll.asciidoc |   4 +-
 ...us-print-spooler-spl-file-created.asciidoc |   4 +-
 ...-service-executable-file-creation.asciidoc |   4 +-
 ...ion-via-renamed-psexec-executable.asciidoc |   4 +-
 ...picious-rdp-activex-client-loaded.asciidoc |   4 +-
 ...creenconnect-client-child-process.asciidoc |  86 +++
 ...spicious-solarwinds-child-process.asciidoc |   4 +-
 ...startup-shell-folder-modification.asciidoc |   4 +-
 ...suspicious-werfault-child-process.asciidoc |   4 +-
 ...process-cluster-spawned-by-a-host.asciidoc |  10 +-
 ...uster-spawned-by-a-parent-process.asciidoc |  10 +-
 ...process-cluster-spawned-by-a-user.asciidoc |  10 +-
 ...ous-wmi-image-load-from-ms-office.asciidoc |   4 +-
 .../suspicious-zoom-child-process.asciidoc    |   4 +-
 .../svchost-spawning-cmd.asciidoc             |   4 +-
 ...bolic-link-to-shadow-copy-created.asciidoc |   4 +-
 .../system-shells-via-services.asciidoc       |   4 +-
 ...es-deleted-via-unexpected-process.asciidoc |   4 +-
 ...nternet-explorer-add-on-installer.asciidoc |   4 +-
 ...eged-ifileoperation-com-interface.asciidoc |   4 +-
 ...ia-windows-directory-masquerading.asciidoc |   4 +-
 ...ademanager-elevated-com-interface.asciidoc |   4 +-
 ...diskcleanup-scheduled-task-hijack.asciidoc |   4 +-
 ...icmluautil-elevated-com-interface.asciidoc |   4 +-
 ...a-windows-firewall-snap-in-hijack.asciidoc |   4 +-
 ...ommon-registry-persistence-change.asciidoc |   4 +-
 .../unsigned-dll-loaded-by-svchost.asciidoc   |   4 +-
 ...-loading-from-a-suspicious-folder.asciidoc |   4 +-
 .../untrusted-driver-loaded.asciidoc          |   4 +-
 ...ess-from-a-system-virtual-process.asciidoc |   4 +-
 .../unusual-child-process-of-dns-exe.asciidoc |   4 +-
 ...usual-child-processes-of-rundll32.asciidoc |   4 +-
 ...tion-by-a-system-critical-process.asciidoc |   4 +-
 ...le-creation-alternate-data-stream.asciidoc |   4 +-
 ...sual-file-modification-by-dns-exe.asciidoc |   4 +-
 ...unusual-parent-child-relationship.asciidoc |   4 +-
 ...nusual-parent-process-for-cmd-exe.asciidoc |   4 +-
 ...persistence-via-services-registry.asciidoc |   4 +-
 ...usual-print-spooler-child-process.asciidoc |   4 +-
 ...cution-path-alternate-data-stream.asciidoc |   4 +-
 ...unusual-process-spawned-by-a-host.asciidoc |  10 +-
 ...ocess-spawned-by-a-parent-process.asciidoc |  10 +-
 ...unusual-process-spawned-by-a-user.asciidoc |  10 +-
 ...t-child-process-childless-service.asciidoc |   4 +-
 .../user-account-creation.asciidoc            |   4 +-
 ...library-loaded-by-unusual-process.asciidoc |   4 +-
 ...y-deleted-or-resized-via-vssadmin.asciidoc |   4 +-
 ...adow-copy-deletion-via-powershell.asciidoc |   4 +-
 ...ume-shadow-copy-deletion-via-wmic.asciidoc |   4 +-
 ...ess-child-of-common-web-processes.asciidoc |   4 +-
 .../whoami-process-activity.asciidoc          |   4 +-
 ...isabled-via-registry-modification.asciidoc |   4 +-
 ...r-exclusions-added-via-powershell.asciidoc |   4 +-
 ...-firewall-disabled-via-powershell.asciidoc |   4 +-
 ...gistry-file-creation-in-smb-share.asciidoc |   4 +-
 ...ndows-script-executing-powershell.asciidoc |   4 +-
 ...-for-linux-distribution-installed.asciidoc |   4 +-
 ...or-linux-enabled-via-dism-utility.asciidoc |   4 +-
 ...ntial-dumping-using-netsh-command.asciidoc |   4 +-
 docs/index.asciidoc                           |   2 +
 539 files changed, 35672 insertions(+), 937 deletions(-)
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-account-discovery-command-via-system-account.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adfind-command-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adobe-hijack-persistence.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-bypass-uac-via-event-viewer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-console-history.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-event-logs.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-execution-via-solarwinds-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-component-object-model-hijacking.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-dns-named-record.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-administrator-accounts.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-removable-device.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-iis-http-logging-disabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-image-file-execution-options-injection.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-custom-shim-databases.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-security-support-provider.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kirbi-file-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lateral-movement-via-startup-folder.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-scheduled-task-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-memory-dump-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-process-access-via-windows-api.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-windows-defender-tampering.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-amsienable-registry-key.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-boot-configuration.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-wdigest-security-provider.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-network-logon-provider-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-nullsessionpipe-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-parent-process-pid-spoofing.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-peripheral-device-discovery.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-powershell-profile.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-port-forwarding-rule-addition.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-filter-manager.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-file-transfer-via-certreq.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-psreflect-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-script-block-logging-disabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-activity-via-compiled-html-file.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-a-duplicated-token.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-program-files-directory-masquerading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rdp-enabled-via-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remotely-started-services-via-rpc.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sip-provider-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-or-run-key-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sunburst-command-and-control-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-certutil-commands.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-explorer-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-imagepath-service-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-office-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-code-compilation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-solarwinds-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-werfault-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-zoom-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-svchost-spawning-cmd.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-system-shells-via-services.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uncommon-registry-persistence-change.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-untrusted-driver-loaded.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-child-relationship.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-persistence-via-services-registry.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-user-account-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-whoami-process-activity.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-script-executing-powershell.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/creation-of-a-dns-named-record.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-execution-via-xzbackdoor.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc
 create mode 100644 docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-account-discovery-command-via-system-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-account-discovery-command-via-system-account.asciidoc
new file mode 100644
index 0000000000..fa7553ec92
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-account-discovery-command-via-system-account.asciidoc
@@ -0,0 +1,141 @@
+[[prebuilt-rule-8-12-8-account-discovery-command-via-system-account]]
+=== Account Discovery Command via SYSTEM Account
+
+Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Account Discovery Command via SYSTEM Account*
+
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed after attackers successfully perform privilege escalation or exploit web applications.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike, investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential webshell backdoor.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system shell using Windows services, scheduled tasks or other third party utilities.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+- Use the data collected through the analysis to investigate other machines affected in the environment.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (?process.Ext.token.integrity_level_name : "System" or
+  ?winlog.event_data.IntegrityLevel : "System") and
+  (
+    process.name : "whoami.exe" or
+    (
+      process.name : "net1.exe" and not process.parent.name : "net.exe" and not process.args : ("start", "stop", "/active:*")
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Owner/User Discovery
+** ID: T1033
+** Reference URL: https://attack.mitre.org/techniques/T1033/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib.asciidoc
new file mode 100644
index 0000000000..b8d3d4d390
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib.asciidoc
@@ -0,0 +1,151 @@
+[[prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib]]
+=== Adding Hidden File Attribute via Attrib
+
+Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Adding Hidden File Attribute via Attrib*
+
+
+The `Hidden` attribute is a file or folder attribute that makes the file or folder invisible to regular directory listings when the attribute is set. 
+
+Attackers can use this attribute to conceal tooling and malware to prevent administrators and users from finding it, even if they are looking specifically for it.
+
+This rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to identify the target file or folder.
+  - Examine the file, which process created it, header, etc.
+  - If suspicious, retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "attrib.exe" or ?process.pe.original_file_name == "ATTRIB.EXE") and process.args : "+h" and
+  not (process.parent.name: "cmd.exe" and process.command_line: "attrib  +R +H +S +A *.cui")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: Hidden Files and Directories
+** ID: T1564.001
+** Reference URL: https://attack.mitre.org/techniques/T1564/001/
+* Technique:
+** Name: File and Directory Permissions Modification
+** ID: T1222
+** Reference URL: https://attack.mitre.org/techniques/T1222/
+* Sub-technique:
+** Name: Windows File and Directory Permissions Modification
+** ID: T1222.001
+** Reference URL: https://attack.mitre.org/techniques/T1222/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adfind-command-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adfind-command-activity.asciidoc
new file mode 100644
index 0000000000..66fbcf2d34
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adfind-command-activity.asciidoc
@@ -0,0 +1,169 @@
+[[prebuilt-rule-8-12-8-adfind-command-activity]]
+=== AdFind Command Activity
+
+This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://www.joeware.net/freetools/tools/adfind/
+* https://thedfirreport.com/2020/05/08/adfind-recon/
+* https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
+* https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware
+* https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html
+* https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating AdFind Command Activity*
+
+
+http://www.joeware.net/freetools/tools/adfind/[AdFind] is a freely available command-line tool used to retrieve information from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and understand subnets and domain information. There are many https://thedfirreport.com/category/adfind/[examples] of this tool being adopted by ransomware and criminal groups and used in compromises.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine the command line to determine what information was retrieved by the tool.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives as it is a legitimate tool used by network administrators.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in isolation, so reviewing previous logs/activity from impacted machines can be very telling.
+
+
+*Related rules*
+
+
+- Windows Network Enumeration - 7b8bfc26-81d2-435e-965c-d722ee397ef1
+- Enumeration of Administrator Accounts - 871ea072-1b71-4def-b016-6278b505138d
+- Enumeration Command Spawned via WMIPrvSE - 770e0c4d-b998-41e5-a62e-c7901fd7f470
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "AdFind.exe" or ?process.pe.original_file_name == "AdFind.exe") and
+  process.args : ("objectcategory=computer", "(objectcategory=computer)",
+                  "objectcategory=person", "(objectcategory=person)",
+                  "objectcategory=subnet", "(objectcategory=subnet)",
+                  "objectcategory=group", "(objectcategory=group)",
+                  "objectcategory=organizationalunit", "(objectcategory=organizationalunit)",
+                  "objectcategory=attributeschema", "(objectcategory=attributeschema)",
+                  "domainlist", "dcmodes", "adinfo", "dclist", "computers_pwnotreqd", "trustdmp")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adobe-hijack-persistence.asciidoc
new file mode 100644
index 0000000000..b32b52b830
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-adobe-hijack-persistence.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-12-8-adobe-hijack-persistence]]
+=== Adobe Hijack Persistence
+
+Detects writing executable files that will be automatically launched by Adobe on launch.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/pabraeken/status/997997818362155008
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Adobe Hijack Persistence*
+
+
+Attackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  file.path : ("?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe",
+               "?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe") and
+  not process.name : "msiexec.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Services File Permissions Weakness
+** ID: T1574.010
+** Reference URL: https://attack.mitre.org/techniques/T1574/010/
+* Technique:
+** Name: Compromise Client Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl.asciidoc
new file mode 100644
index 0000000000..0bc62ecc6a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl]]
+=== Attempt to Install Kali Linux via WSL
+
+Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+ (process.name : "wsl.exe" and process.args : ("-d", "--distribution", "-i", "--install") and process.args : "kali*") or 
+ process.executable : 
+        ("?:\\Users\\*\\AppData\\Local\\packages\\kalilinux*", 
+         "?:\\Users\\*\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe",
+         "?:\\Program Files*\\WindowsApps\\KaliLinux.*\\kali.exe")
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-bypass-uac-via-event-viewer.asciidoc
new file mode 100644
index 0000000000..09b73a0758
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-bypass-uac-via-event-viewer.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-12-8-bypass-uac-via-event-viewer]]
+=== Bypass UAC via Event Viewer
+
+Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Bypass UAC via Event Viewer*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+During startup, `eventvwr.exe` checks the registry value of the `HKCU\Software\Classes\mscfile\shell\open\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "eventvwr.exe" and
+  not process.executable :
+            ("?:\\Windows\\SysWOW64\\mmc.exe",
+             "?:\\Windows\\System32\\mmc.exe",
+             "?:\\Windows\\SysWOW64\\WerFault.exe",
+             "?:\\Windows\\System32\\WerFault.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-console-history.asciidoc
new file mode 100644
index 0000000000..b66c878941
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-console-history.asciidoc
@@ -0,0 +1,149 @@
+[[prebuilt-rule-8-12-8-clearing-windows-console-history]]
+=== Clearing Windows Console History
+
+Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/
+* https://www.shellhacks.com/clear-history-powershell/
+* https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Console History*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+  - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name == "PowerShell.EXE") and
+     (process.args : "*Clear-History*" or
+     (process.args : ("*Remove-Item*", "rm") and process.args : ("*ConsoleHost_history.txt*", "*(Get-PSReadlineOption).HistorySavePath*")) or
+     (process.args : "*Set-PSReadlineOption*" and process.args : "*SaveNothing*"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Command History
+** ID: T1070.003
+** Reference URL: https://attack.mitre.org/techniques/T1070/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-event-logs.asciidoc
new file mode 100644
index 0000000000..36ae0a1ec2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-clearing-windows-event-logs.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-12-8-clearing-windows-event-logs]]
+=== Clearing Windows Event Logs
+
+Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Clearing Windows Event Logs*
+
+
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+
+This rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.
+- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (process.name : "wevtutil.exe" or ?process.pe.original_file_name == "wevtutil.exe") and
+    process.args : ("/e:false", "cl", "clear-log")
+  ) or
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+    process.args : "Clear-EventLog"
+  )
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools.asciidoc
new file mode 100644
index 0000000000..a749ffe3ae
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools]]
+=== Code Signing Policy Modification Through Built-in tools
+
+Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Code Signing Policy Modification Through Built-in tools*
+
+
+Windows Driver Signature Enforcement (DSE) is a security feature introduced by Microsoft to enforce that only signed drivers can be loaded and executed into the kernel (ring 0). This feature was introduced to prevent attackers from loading their malicious drivers on targets. If the driver has an invalid signature, the system will not allow it to be loaded.
+
+This protection is essential for maintaining the security of the system. However, attackers or even administrators can disable this feature and load untrusted drivers, as this can put the system at risk. Therefore, it is important to keep this feature enabled and only load drivers from trusted sources to ensure the integrity and security of the system.
+
+This rule identifies commands that can disable the Driver Signature Enforcement feature.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Use Osquery and endpoint driver events (`event.category = "driver"`) to investigate if suspicious drivers were loaded into the system after the command was executed.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Related Rules*
+
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name: "bcdedit.exe" or ?process.pe.original_file_name == "bcdedit.exe") and process.args: ("-set", "/set") and 
+  process.args: ("TESTSIGNING", "nointegritychecks", "loadoptions", "DISABLE_INTEGRITY_CHECKS")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Code Signing Policy Modification
+** ID: T1553.006
+** Reference URL: https://attack.mitre.org/techniques/T1553/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry.asciidoc
new file mode 100644
index 0000000000..0538290b5f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry.asciidoc
@@ -0,0 +1,146 @@
+[[prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry]]
+=== Code Signing Policy Modification Through Registry
+
+Identifies attempts to disable the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Code Signing Policy Modification Through Registry*
+
+
+Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. 
+
+This protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.
+
+This rule identifies registry modifications that can disable DSE.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Use Osquery and endpoint driver events (`event.category = "driver"`) to investigate if suspicious drivers were loaded into the system after the registry was modified.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Related Rules*
+
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type : ("creation", "change") and
+(
+  registry.path : (
+    "HKEY_USERS\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify",
+    "HKU\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify",
+    "\\REGISTRY\\USER\\*\\Software\\Policies\\Microsoft\\Windows NT\\Driver Signing\\BehaviorOnFailedVerify"
+  ) and
+  registry.value: "BehaviorOnFailedVerify" and
+  registry.data.strings : ("0", "0x00000000", "1", "0x00000001")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Code Signing Policy Modification
+** ID: T1553.006
+** Reference URL: https://attack.mitre.org/techniques/T1553/006/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-execution-via-solarwinds-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-execution-via-solarwinds-process.asciidoc
new file mode 100644
index 0000000000..9e951eabe1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-execution-via-solarwinds-process.asciidoc
@@ -0,0 +1,110 @@
+[[prebuilt-rule-8-12-8-command-execution-via-solarwinds-process]]
+=== Command Execution via SolarWinds Process
+
+A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
+* https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20FILEWRITES%20(METHODOLOGY).ioc
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name: ("cmd.exe", "powershell.exe") and
+process.parent.name: (
+     "ConfigurationWizard*.exe",
+     "NetflowDatabaseMaintenance*.exe",
+     "NetFlowService*.exe",
+     "SolarWinds.Administration*.exe",
+     "SolarWinds.Collector.Service*.exe",
+     "SolarwindsDiagnostics*.exe"
+     )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Supply Chain Compromise
+** ID: T1195
+** Reference URL: https://attack.mitre.org/techniques/T1195/
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32.asciidoc
new file mode 100644
index 0000000000..14f48c10d5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32]]
+=== Command Shell Activity Started via RunDLL32
+
+Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Credential Access
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.name : ("cmd.exe", "powershell.exe") and
+  process.parent.name : "rundll32.exe" and process.parent.command_line != null and
+  /* common FPs can be added here */
+  not process.parent.args : ("C:\\Windows\\System32\\SHELL32.dll,RunAsNewUser_RunDLL",
+                             "C:\\WINDOWS\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-component-object-model-hijacking.asciidoc
new file mode 100644
index 0000000000..6a0131e17a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-component-object-model-hijacking.asciidoc
@@ -0,0 +1,269 @@
+[[prebuilt-rule-8-12-8-component-object-model-hijacking]]
+=== Component Object Model Hijacking
+
+Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Component Object Model Hijacking*
+
+
+Adversaries can insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means of persistence.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Retrieve the file referenced in the registry and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- Some Microsoft executables will reference the LocalServer32 registry key value for the location of external COM objects.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+  /* not necessary but good for filtering privileged installations */
+  user.domain != "NT AUTHORITY" and
+  (
+    (
+      registry.path : "HK*\\InprocServer32\\" and
+      registry.data.strings: ("scrobj.dll", "?:\\*\\scrobj.dll") and
+      not registry.path : "*\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\*"
+    ) or
+
+    (
+      registry.path : "HKLM\\*\\InProcServer32\\*" and
+        registry.data.strings : ("*\\Users\\*", "*\\ProgramData\\*")
+    ) or
+
+    /* in general COM Registry changes on Users Hive is less noisy and worth alerting */
+    (
+      registry.path : (
+        "HKEY_USERS\\*\\InprocServer32\\",
+        "HKEY_USERS\\*\\LocalServer32\\",
+        "HKEY_USERS\\*\\DelegateExecute",
+        "HKEY_USERS\\*\\TreatAs\\",
+        "HKEY_USERS\\*\\ScriptletURL*"
+      ) and
+      not 
+      (
+        (
+          process.name : "svchost.exe" and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Microsoft Windows Publisher" and
+            registry.value : "DelegateExecute" and
+            registry.data.strings : (
+              /* https://strontic.github.io/xcyclopedia/library/clsid_4ED3A719-CEA8-4BD9-910D-E252F997AFC2.html */
+              "{4ED3A719-CEA8-4BD9-910D-E252F997AFC2}",
+
+              /* https://strontic.github.io/xcyclopedia/library/clsid_A56A841F-E974-45C1-8001-7E3F8A085917.html */
+              "{A56A841F-E974-45C1-8001-7E3F8A085917}",
+
+              /* https://strontic.github.io/xcyclopedia/library/clsid_BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78.html */
+              "{BFEC0C93-0B7D-4F2C-B09C-AFFFC4BDAE78}",
+              "%SystemRoot%\\system32\\shdocvw.dll"
+            )
+        ) or
+        (
+          process.name : "veeam.backup.shell.exe" and
+            registry.path : "HKEY_USERS\\S-1-*_Classes\\CLSID\\*\\LocalServer32\\" and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Veeam Software Group GmbH"
+        ) or 
+        (
+          process.name : ("ADNotificationManager.exe", "Creative Cloud.exe") and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Adobe Inc." and
+            registry.data.strings : (
+              "\"?:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\ADNotificationManager.exe\" -ToastActivated",
+              "\"?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\ADNotificationManager.exe\" -ToastActivated",
+              "\"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ADNotificationManager.exe\" -ToastActivated",
+              "\"?:\\Program Files\\Adobe\\Acrobat Reader DC\\Reader\\ADNotificationManager.exe\" -ToastActivated",
+              "\"?:\\Program Files\\Adobe\\Adobe Creative Cloud\\ACC\\Creative Cloud.exe\" -ToastActivated"
+            )
+        ) or 
+        (
+          process.name : ("IslandUpdateComRegisterShell64.exe", "IslandUpdate.exe", "GoogleUpdateComRegisterShell64.exe") and
+            process.code_signature.trusted == true and
+            process.code_signature.subject_name in ("Island Technology Inc.", "Google LLC") and
+            registry.data.strings : (
+              "*?:\\Users\\*\\AppData\\Local\\Island\\Update\\*",
+              "*?:\\Users\\*\\AppData\\Local\\Google\\Update\\*"
+            )
+        ) or 
+        (
+          process.name : ("SelfService.exe", "WfShell.exe") and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Citrix Systems, Inc." and
+            registry.data.strings : (
+              "\"?:\\Program Files (x86)\\Citrix\\ICA Client\\SelfServicePlugin\\SelfService.exe\" -ToastActivated",
+              "%SystemRoot%\\system32\\shdocvw.dll",
+              "%SystemRoot%\\sysWOW64\\shdocvw.dll"
+            )
+        ) or 
+        (
+          process.name : ("msrdcw.exe") and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Microsoft Corporation" and
+            registry.data.strings : (
+              "\"?:\\Program Files\\Remote Desktop\\msrdcw.exe\" -ToastActivated",
+              "\"?:\\Users\\*\\AppData\\Local\\Apps\\Remote Desktop\\msrdcw.exe\" -ToastActivated"
+            )
+        ) or 
+        (
+          process.name : ("ssvagent.exe") and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "Oracle America, Inc." and
+            registry.data.strings : (
+              "?:\\Program Files\\Java\\jre*\\bin\\jp2iexp.dll",
+              "?:\\Program Files (x86)\\Java\\jre*\\bin\\jp2iexp.dll"
+            )
+        ) or 
+        (
+          process.name : ("hpnotifications.exe") and
+            process.code_signature.trusted == true and process.code_signature.subject_name == "HP Inc." and
+            registry.data.strings : (
+              "\"?:\\Windows\\System32\\DriverStore\\FileRepository\\hpsvcsscancomp.inf_amd64_*\\x64\\hpnotifications.exe\" -ToastActivated"
+            )
+        )
+      )
+    )
+  ) and
+
+  /* removes false-positives generated by OneDrive and Teams */
+  not
+  (
+    process.name: ("OneDrive.exe", "OneDriveSetup.exe", "FileSyncConfig.exe", "Teams.exe") and
+    process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation")
+  ) and
+
+  /* Teams DLL loaded by regsvr */
+  not (process.name: "regsvr32.exe" and registry.data.strings : "*Microsoft.Teams.*.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Component Object Model Hijacking
+** ID: T1546.015
+** Reference URL: https://attack.mitre.org/techniques/T1546/015/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Component Object Model Hijacking
+** ID: T1546.015
+** Reference URL: https://attack.mitre.org/techniques/T1546/015/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process.asciidoc
new file mode 100644
index 0000000000..f91dcc5afc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process]]
+=== Conhost Spawned By Suspicious Parent Process
+
+Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Conhost Spawned By Suspicious Parent Process*
+
+
+The Windows Console Host, or `conhost.exe`, is both the server application for all of the Windows Console APIs as well as the classic Windows user interface for working with command-line applications.
+
+Attackers often rely on custom shell implementations to avoid using built-in command interpreters like `cmd.exe` and `PowerShell.exe` and bypass application allowlisting and security features. Attackers commonly inject these implementations into legitimate system processes.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Retrieve the parent process executable and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related rules*
+
+
+- Suspicious Process from Conhost - 28896382-7d4f-4d50-9b72-67091901fd26
+- Suspicious PowerShell Engine ImageLoad - 852c1f19-68e8-43a6-9dce-340771fe1be3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "conhost.exe" and
+  process.parent.name : ("lsass.exe", "services.exe", "smss.exe", "winlogon.exe", "explorer.exe", "dllhost.exe", "rundll32.exe",
+                         "regsvr32.exe", "userinit.exe", "wininit.exe", "spoolsv.exe", "ctfmon.exe") and
+  not (process.parent.name : "rundll32.exe" and
+       process.parent.args : ("?:\\Windows\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc",
+                              "?:\\WINDOWS\\system32\\PcaSvc.dll,PcaPatchSdbTask",
+                              "?:\\WINDOWS\\system32\\davclnt.dll,DavSetCookie"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
new file mode 100644
index 0000000000..cbea24421d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers]]
+=== Connection to Commonly Abused Free SSL Certificate Providers
+
+Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.network-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+  /* Add new free SSL certificate provider domains here */
+  dns.question.name : ("*letsencrypt.org", "*.sslforfree.com", "*.zerossl.com", "*.freessl.org") and
+
+  /* Native Windows process paths that are unlikely to have network connections to domains secured using free SSL certificates */
+  process.executable : ("C:\\Windows\\System32\\*.exe",
+                        "C:\\Windows\\System\\*.exe",
+	                  "C:\\Windows\\SysWOW64\\*.exe",
+		          "C:\\Windows\\Microsoft.NET\\Framework*\\*.exe",
+		          "C:\\Windows\\explorer.exe",
+		          "C:\\Windows\\notepad.exe") and
+
+  /* Insert noisy false positives here */
+  not process.name : ("svchost.exe", "MicrosoftEdge*.exe", "msedge.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Encrypted Channel
+** ID: T1573
+** Reference URL: https://attack.mitre.org/techniques/T1573/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services.asciidoc
new file mode 100644
index 0000000000..ad9d1edc7a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services.asciidoc
@@ -0,0 +1,284 @@
+[[prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services]]
+=== Connection to Commonly Abused Web Services
+
+Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Connection to Commonly Abused Web Services*
+
+
+Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.
+
+This rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Verify whether the digital signature exists in the executable.
+- Identify the operation type (upload, download, tunneling, etc.).
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and network.protocol == "dns" and
+    process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+    /* Add new WebSvc domains here */
+    dns.question.name :
+       (
+        "raw.githubusercontent.*",
+        "github.com",
+        "pastebin.*",
+        "paste4btc.com",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "?.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "*.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
+        "*serveo.net",
+        "*localtunnel.me",
+        "*pagekite.me",
+        "*localxpose.io",
+        "*notabug.org",
+        "rawcdn.githack.*",
+        "paste.nrecom.net",
+        "zerobin.net",
+        "controlc.com",
+        "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
+        "cdn.discordapp.com",
+        "discordapp.com",
+        "discord.com",
+        "apis.azureedge.net",
+        "cdn.sql.gg",
+        "?.top4top.io",
+        "top4top.io",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "gofile.io",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "t.me",
+        "meacz.gq",
+        "rwrd.org",
+        "*.publicvm.com",
+        "*.blogspot.com",
+        "api.mylnikov.org",
+        "file.io",
+        "stackoverflow.com",
+        "*files.1drv.com",
+        "api.anonfile.com",
+        "*hosting-profi.de",
+        "ipbase.com",
+        "ipfs.io",
+        "*up.freeo*.space",
+        "api.mylnikov.org",
+        "script.google.com",
+        "script.googleusercontent.com",
+        "api.notion.com",
+        "graph.microsoft.com",
+        "*.sharepoint.com",
+        "mbasic.facebook.com",
+        "login.live.com",
+        "api.gofile.io",
+        "api.anonfiles.com",
+        "api.notion.com",
+        "api.trello.com",
+        "gist.githubusercontent.com",
+        "files.pythonhosted.org",
+        "g.live.com",
+        "*.zulipchat.com",
+        "graph.microsoft.com") and 
+        
+    /* Insert noisy false positives here */
+    not (
+      (
+        process.executable : (
+          "?:\\Program Files\\*.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\Windows\\System32\\WWAHost.exe",
+          "?:\\Windows\\System32\\smartscreen.exe",
+          "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+          "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
+          "?:\\Users\\*\\AppData\\Local\\BraveSoftware\\*\\Application\\brave.exe",
+          "?:\\Users\\*\\AppData\\Local\\Vivaldi\\Application\\vivaldi.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Opera*\\opera.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Fiddler\\Fiddler.exe",
+          "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
+          "?:\\Windows\\system32\\mobsync.exe",
+          "?:\\Windows\\SysWOW64\\mobsync.exe"
+        ) and process.code_signature.trusted == true
+      ) or
+    
+      /* Discord App */
+      (process.name : "Discord.exe" and (process.code_signature.subject_name : "Discord Inc." and
+       process.code_signature.trusted == true) and dns.question.name : ("discord.com", "cdn.discordapp.com", "discordapp.com")
+      ) or 
+
+      /* MS Sharepoint */
+      (process.name : "Microsoft.SharePoint.exe" and (process.code_signature.subject_name : "Microsoft Corporation" and
+       process.code_signature.trusted == true) and dns.question.name : "onedrive.live.com"
+      ) or 
+
+      /* Firefox */
+      (process.name : "firefox.exe" and (process.code_signature.subject_name : "Mozilla Corporation" and
+       process.code_signature.trusted == true)
+      ) or 
+
+      /* Dropbox */
+      (process.name : "Dropbox.exe" and (process.code_signature.subject_name : "Dropbox, Inc" and
+       process.code_signature.trusted == true) and dns.question.name : ("api.dropboxapi.com", "*.dropboxusercontent.com")
+      ) or 
+
+      /* Obsidian - Plugins are stored on raw.githubusercontent.com */
+      (process.name : "Obsidian.exe" and (process.code_signature.subject_name : "Dynalist Inc" and
+       process.code_signature.trusted == true) and dns.question.name : "raw.githubusercontent.com"
+      ) or 
+
+      /* WebExperienceHostApp */
+      (process.name : "WebExperienceHostApp.exe" and (process.code_signature.subject_name : "Microsoft Windows" and
+       process.code_signature.trusted == true) and dns.question.name : ("onedrive.live.com", "skyapi.onedrive.live.com")
+      )
+    ) 
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Web Service
+** ID: T1102
+** Reference URL: https://attack.mitre.org/techniques/T1102/
+* Technique:
+** Name: Dynamic Resolution
+** ID: T1568
+** Reference URL: https://attack.mitre.org/techniques/T1568/
+* Sub-technique:
+** Name: Domain Generation Algorithms
+** ID: T1568.002
+** Reference URL: https://attack.mitre.org/techniques/T1568/002/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
+* Sub-technique:
+** Name: Exfiltration to Code Repository
+** ID: T1567.001
+** Reference URL: https://attack.mitre.org/techniques/T1567/001/
+* Sub-technique:
+** Name: Exfiltration to Cloud Storage
+** ID: T1567.002
+** Reference URL: https://attack.mitre.org/techniques/T1567/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments.asciidoc
new file mode 100644
index 0000000000..ebd6230ccb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments.asciidoc
@@ -0,0 +1,99 @@
+[[prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments]]
+=== Control Panel Process with Unusual Arguments
+
+Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.joesandbox.com/analysis/476188/1/html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : ("?:\\Windows\\SysWOW64\\control.exe", "?:\\Windows\\System32\\control.exe") and
+ process.command_line :
+          ("*.jpg*",
+           "*.png*",
+           "*.gif*",
+           "*.bmp*",
+           "*.jpeg*",
+           "*.TIFF*",
+           "*.inf*",
+           "*.cpl:*/*",
+           "*../../..*",
+           "*/AppData/Local/*",
+           "*:\\Users\\Public\\*",
+           "*\\AppData\\Local\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Control Panel
+** ID: T1218.002
+** Reference URL: https://attack.mitre.org/techniques/T1218/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-dns-named-record.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-dns-named-record.asciidoc
new file mode 100644
index 0000000000..ce88a617d2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-dns-named-record.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-8-creation-of-a-dns-named-record]]
+=== Creation of a DNS-Named Record
+
+Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.netspi.com/blog/technical/network-penetration-testing/adidns-revisited/
+* https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/wpad-spoofing
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Use Case: Active Directory Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and event.action == "Directory Service Changes" and
+    event.code == "5137" and winlog.event_data.ObjectClass == "dnsNode" and
+    not winlog.event_data.SubjectUserName : "*$"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account.asciidoc
new file mode 100644
index 0000000000..4e33574226
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account]]
+=== Creation of a Hidden Local User Account
+
+Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html
+* https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Creation of a Hidden Local User Account*
+
+
+Attackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and bypass detections that identify computer accounts by this pattern to apply filters.
+
+This rule uses registry events to identify the creation of local hidden accounts.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positive (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Delete the hidden account.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\",
+    "\\REGISTRY\\MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names\\*$\\"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
new file mode 100644
index 0000000000..6f06b2c4ba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service]]
+=== Creation or Modification of a new GPO Scheduled Task or Service
+
+Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.path : ("?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml",
+               "?:\\Windows\\SYSVOL\\domain\\Policies\\*\\MACHINE\\Preferences\\Services\\Services.xml") and
+  not process.name : "dfsrs.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Domain Policy Modification
+** ID: T1484
+** Reference URL: https://attack.mitre.org/techniques/T1484/
+* Sub-technique:
+** Name: Group Policy Modification
+** ID: T1484.001
+** Reference URL: https://attack.mitre.org/techniques/T1484/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
new file mode 100644
index 0000000000..85d8f39b56
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
@@ -0,0 +1,99 @@
+[[prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key]]
+=== Creation or Modification of Domain Backup DPAPI private key
+
+Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/
+* https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+Domain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and file.name : ("ntds_capi_*.pfx", "ntds_capi_*.pvk")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Unsecured Credentials
+** ID: T1552
+** Reference URL: https://attack.mitre.org/techniques/T1552/
+* Sub-technique:
+** Name: Private Keys
+** ID: T1552.004
+** Reference URL: https://attack.mitre.org/techniques/T1552/004/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate.asciidoc
new file mode 100644
index 0000000000..bd080b25f1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate.asciidoc
@@ -0,0 +1,176 @@
+[[prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate]]
+=== Creation or Modification of Root Certificate
+
+Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
+* https://www.ired.team/offensive-security/persistence/t1130-install-root-certificate
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Creation or Modification of Root Certificate*
+
+
+Root certificates are the primary level of certifications that tell a browser that the communication is trusted and legitimate. This verification is based upon the identification of a certification authority. Windows adds several trusted root certificates so browsers can use them to communicate with websites.
+
+https://www.thewindowsclub.com/what-are-root-certificates-windows[Check out this post] for more details on root certificates and the involved cryptography.
+
+This rule identifies the creation or modification of a root certificate by monitoring registry modifications. The installation of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate abnormal behaviors observed by the subject process such as network connections, other registry or file modifications, and any spawned child processes.
+- If one of the processes is suspicious, retrieve it and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove the malicious certificate from the root certificate store.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path :
+    (
+      "HKLM\\Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "HKLM\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\Root\\Certificates\\*\\Blob",
+      "\\REGISTRY\\MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\*\\Blob"
+    ) and
+  not process.executable : (
+          "?:\\ProgramData\\Lenovo\\Vantage\\Addins\\LenovoHardwareScanAddin\\*\\LdeApi.Server.exe",
+          "?:\\ProgramData\\Logishrd\\LogiOptionsPlus\\Plugins\\64\\certmgr.exe",
+          "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+          "?:\\ProgramData\\Quest\\KACE\\modules\\clientidentifier\\clientidentifier.exe",
+          "?:\\Program Files (x86)\\*.exe",
+          "?:\\Program Files\\*.exe",
+          "?:\\Windows\\CCM\\CcmExec.exe",
+          "?:\\Windows\\ccmsetup\\cache\\ccmsetup.exe",
+          "?:\\Windows\\Cluster\\clussvc.exe",
+          "?:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
+          "?:\\Windows\\Lenovo\\ImController\\PluginHost86\\Lenovo.Modern.ImController.PluginHost.Device.exe",
+          "?:\\Windows\\Lenovo\\ImController\\Service\\Lenovo.Modern.ImController.exe",
+          "?:\\Windows\\Sysmon.exe",
+          "?:\\Windows\\Sysmon64.exe",
+          "?:\\Windows\\System32\\*.exe",
+          "?:\\Windows\\SysWOW64\\*.exe",
+          "?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\WinSxS\\*.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: Install Root Certificate
+** ID: T1553.004
+** Reference URL: https://attack.mitre.org/techniques/T1553/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping.asciidoc
new file mode 100644
index 0000000000..6987abc42b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping]]
+=== Credential Acquisition via Registry Hive Dumping
+
+Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Credential Acquisition via Registry Hive Dumping*
+
+
+Dumping registry hives is a common way to access credential information as some hives store credential material.
+
+For example, the SAM hive stores locally cached credentials (SAM Secrets), and the SECURITY hive stores domain cached credentials (LSA secrets).
+
+Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
+
+This rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, which potentially indicates the compromise of the credentials stored in the host.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate if the credential material was exfiltrated or processed locally by other tools.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
+
+
+*False positive analysis*
+
+
+- Administrators can export registry hives for backup purposes using command line tools like `reg.exe`. Check whether the user is legitamitely performing this kind of activity.
+
+
+*Related rules*
+
+
+- Registry Hive File Creation via SMB - a4c7473a-5cb4-4bc1-9d06-e4a75adbc494
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (?process.pe.original_file_name == "reg.exe" or process.name : "reg.exe") and
+ process.args : ("save", "export") and
+ process.args : ("hklm\\sam", "hklm\\security")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Sub-technique:
+** Name: LSA Secrets
+** ID: T1003.004
+** Reference URL: https://attack.mitre.org/techniques/T1003/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil.asciidoc
new file mode 100644
index 0000000000..50573a180d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil.asciidoc
@@ -0,0 +1,117 @@
+[[prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil]]
+=== Delete Volume USN Journal with Fsutil
+
+Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Delete Volume USN Journal with Fsutil*
+
+
+The Update Sequence Number (USN) Journal is a feature in the NTFS file system used by Microsoft Windows operating systems to keep track of changes made to files and directories on a disk volume. The journal records metadata for changes such as file creation, deletion, modification, and permission changes. It is used by the operating system for various purposes, including backup and recovery, file indexing, and file replication.
+
+This artifact can provide valuable information in forensic analysis, such as programs executed (prefetch file operations), file modification events in suspicious directories, deleted files, etc. Attackers may delete this artifact in an attempt to cover their tracks, and this rule identifies the usage of the `fsutil.exe` utility to accomplish it.
+
+Consider using the Elastic Defend integration instead of USN Journal, as the Elastic Defend integration provides more visibility and context in the file operations it records.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Review file operation logs from Elastic Defend for suspicious activity the attacker tried to hide.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "fsutil.exe" or ?process.pe.original_file_name == "fsutil.exe") and
+  process.args : "deletejournal" and process.args : "usn"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin.asciidoc
new file mode 100644
index 0000000000..709bf6baca
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin.asciidoc
@@ -0,0 +1,140 @@
+[[prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin]]
+=== Deleting Backup Catalogs with Wbadmin
+
+Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Deleting Backup Catalogs with Wbadmin*
+
+
+Windows Server Backup stores the details about your backups (what volumes are backed up and where the backups are located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files. Deleting these files is a common step in threat actor playbooks.
+
+This rule identifies the deletion of the backup catalog using the `wbadmin.exe` utility.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Check if any files on the host machine have been encrypted.
+
+
+*False positive analysis*
+
+
+- Administrators can use this command to delete corrupted catalogs, but overall the activity is unlikely to be legitimate.
+
+
+*Related rules*
+
+
+- Third-party Backup Files Deleted via Unexpected Process - 11ea6bec-ebde-4d71-a8e9-784948f8e3e9
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- If any backups were affected:
+  - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "wbadmin.exe" or ?process.pe.original_file_name == "WBADMIN.EXE") and
+  process.args : "catalog" and process.args : "delete"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
new file mode 100644
index 0000000000..23d4040090
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools]]
+=== Disable Windows Event and Security Logs Using Built-in Tools
+
+Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman
+* https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+* Ivan Ninichuck
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disable Windows Event and Security Logs Using Built-in Tools*
+
+
+Windows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.
+
+This rule looks for the usage of different utilities to disable the EventLog service or specific event logs.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Re-enable affected logging components, services, and security monitoring.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  ((process.name:"logman.exe" or ?process.pe.original_file_name == "Logman.exe") and
+      process.args : "EventLog-*" and process.args : ("stop", "delete")) or
+
+  ((process.name : ("pwsh.exe", "powershell.exe", "powershell_ise.exe") or ?process.pe.original_file_name in
+      ("pwsh.exe", "powershell.exe", "powershell_ise.exe")) and
+	process.args : "Set-Service" and process.args: "EventLog" and process.args : "Disabled")  or
+
+  ((process.name:"auditpol.exe" or ?process.pe.original_file_name == "AUDITPOL.EXE") and process.args : "/success:disable")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: Clear Windows Event Logs
+** ID: T1070.001
+** Reference URL: https://attack.mitre.org/techniques/T1070/001/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh.asciidoc
new file mode 100644
index 0000000000..a75471ea77
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh.asciidoc
@@ -0,0 +1,132 @@
+[[prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh]]
+=== Disable Windows Firewall Rules via Netsh
+
+Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disable Windows Firewall Rules via Netsh*
+
+
+The Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a device, and blocks unauthorized network traffic flowing into or out of the local device.
+
+Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.
+
+This rule identifies patterns related to disabling the Windows firewall or its rules using the `netsh.exe` utility.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the user to check if they are aware of the operation.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
+- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "netsh.exe" and
+  (
+    (process.args : "disable" and process.args : "firewall" and process.args : "set") or
+    (process.args : "advfirewall" and process.args : "off" and process.args : "state")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification.asciidoc
new file mode 100644
index 0000000000..87cbadf671
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification.asciidoc
@@ -0,0 +1,182 @@
+[[prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification]]
+=== Disabling User Account Control via Registry Modification
+
+User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.greyhathacker.net/?p=796
+* https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings
+* https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disabling User Account Control via Registry Modification*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+Attackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to bypass the UAC protection.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behaviors in the alert timeframe.
+- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Analyze non-system processes executed with high integrity after UAC was disabled for unknown or suspicious processes.
+- Retrieve the suspicious processes' executables and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled tasks creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restore UAC settings to the desired state.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  registry.path :
+    (
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin",
+      "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop"
+    ) and
+  registry.data.strings : ("0", "0x00000000")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell.asciidoc
new file mode 100644
index 0000000000..48cd64787c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -0,0 +1,156 @@
+[[prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell]]
+=== Disabling Windows Defender Security Settings via PowerShell
+
+Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Disabling Windows Defender Security Settings via PowerShell*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
+
+This rule monitors the execution of commands that can tamper the Windows Defender antivirus features.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state, sample submission, etc.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
+
+
+*Related rules*
+
+
+- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
+- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Based on the command line, take actions to restore the appropriate Windows Defender antivirus configurations.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+    ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")
+  ) and
+  process.args : "Set-MpPreference" and process.args : ("-Disable*", "Disabled", "NeverSend", "-Exclusion*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry.asciidoc
new file mode 100644
index 0000000000..ab2993456c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry.asciidoc
@@ -0,0 +1,91 @@
+[[prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry]]
+=== DNS-over-HTTPS Enabled via Registry
+
+Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html
+* https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (registry.path : "*\\SOFTWARE\\Policies\\Microsoft\\Edge\\BuiltInDnsClientEnabled" and
+  registry.data.strings : "1") or
+  (registry.path : "*\\SOFTWARE\\Google\\Chrome\\DnsOverHttpsMode" and
+  registry.data.strings : "secure") or
+  (registry.path : "*\\SOFTWARE\\Policies\\Mozilla\\Firefox\\DNSOverHTTPS" and
+  registry.data.strings : "1")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh.asciidoc
new file mode 100644
index 0000000000..3527c963bc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh]]
+=== Enable Host Network Discovery via Netsh
+
+Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Enable Host Network Discovery via Netsh*
+
+
+The Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
+
+Attackers can enable Network Discovery on the Windows firewall to find other systems present in the same network. Systems with this setting enabled will communicate with other systems using broadcast messages, which can be used to identify targets for lateral movement. This rule looks for the setup of this setting using the netsh utility.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Disable Network Discovery:
+    - Using netsh: `netsh advfirewall firewall set rule group="Network Discovery" new enable=No`
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+process.name : "netsh.exe" and
+process.args : ("firewall", "advfirewall") and process.args : "group=Network Discovery" and process.args : "enable=Yes"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry.asciidoc
new file mode 100644
index 0000000000..42a6620b27
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry.asciidoc
@@ -0,0 +1,69 @@
+[[prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry]]
+=== Encoded Executable Stored in the Registry
+
+Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+/* update here with encoding combinations */
+ registry.data.strings : "TVqQAAMAAAAEAAAA*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z.asciidoc
new file mode 100644
index 0000000000..5a10830711
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z]]
+=== Encrypting Files with WinRar or 7z
+
+Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Encrypting Files with WinRar or 7z*
+
+
+Attackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.
+
+These steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Retrieve the encrypted file.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if the password used in the encryption was included in the command line.
+- Decrypt the `.rar`/`.zip` and check if the information is sensitive.
+- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the file names included in the encrypted file.
+- Investigate if the file was transferred to an attacker-controlled server.
+
+
+*False positive analysis*
+
+
+- Backup software can use these utilities. Check the `process.parent.executable` and `process.parent.command_line` fields to determine what triggered the encryption.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (
+      process.name:"rar.exe" or ?process.code_signature.subject_name == "win.rar GmbH" or
+      ?process.pe.original_file_name == "Command line RAR"
+    ) and
+    process.args == "a" and process.args : ("-hp*", "-p*", "/hp*", "/p*")
+  ) or
+  (
+    ?process.pe.original_file_name in ("7z.exe", "7za.exe") and
+    process.args == "a" and process.args : "-p*"
+  )
+) and
+  not process.parent.executable : (
+        "C:\\Program Files\\*.exe",
+        "C:\\Program Files (x86)\\*.exe",
+        "?:\\ManageEngine\\*\\jre\\bin\\java.exe",
+        "?:\\Nox\\bin\\Nox.exe"
+      )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Archive Collected Data
+** ID: T1560
+** Reference URL: https://attack.mitre.org/techniques/T1560/
+* Sub-technique:
+** Name: Archive via Utility
+** ID: T1560.001
+** Reference URL: https://attack.mitre.org/techniques/T1560/001/
+* Technique:
+** Name: Data from Local System
+** ID: T1005
+** Reference URL: https://attack.mitre.org/techniques/T1005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe.asciidoc
new file mode 100644
index 0000000000..21f6191b53
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe.asciidoc
@@ -0,0 +1,121 @@
+[[prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe]]
+=== Enumerating Domain Trusts via DSQUERY.EXE
+
+Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
+* https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Enumerating Domain Trusts via DSQUERY.EXE*
+
+
+Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
+
+This rule identifies the usage of the `dsquery.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Related rules*
+
+
+- Enumerating Domain Trusts via NLTEST.EXE - 84da2554-e12a-11ec-b896-f661ea17fbcd
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    (process.name : "dsquery.exe" or ?process.pe.original_file_name: "dsquery.exe") and 
+    process.args : "*objectClass=trustedDomain*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe.asciidoc
new file mode 100644
index 0000000000..a072bea6f8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe]]
+=== Enumerating Domain Trusts via NLTEST.EXE
+
+Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
+* https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Enumerating Domain Trusts via NLTEST.EXE*
+
+
+Active Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a "trusting" domain permits users from a "trusted" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.
+
+This rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Related rules*
+
+
+- Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    process.name : "nltest.exe" and process.args : (
+        "/DCLIST:*", "/DCNAME:*", "/DSGET*",
+        "/LSAQUERYFTI:*", "/PARENTDOMAIN",
+        "/DOMAIN_TRUSTS", "/BDC_QUERY:*"
+        ) and 
+not process.parent.name : "PDQInventoryScanner.exe" and 
+not user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse.asciidoc
new file mode 100644
index 0000000000..4977b928c3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse.asciidoc
@@ -0,0 +1,137 @@
+[[prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse]]
+=== Enumeration Command Spawned via WMIPrvSE
+
+Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.command_line != null and 
+  process.name:
+  (
+    "arp.exe",
+    "dsquery.exe",
+    "dsget.exe",
+    "gpresult.exe",
+    "hostname.exe",
+    "ipconfig.exe",
+    "nbtstat.exe",
+    "net.exe",
+    "net1.exe",
+    "netsh.exe",
+    "netstat.exe",
+    "nltest.exe",
+    "ping.exe",
+    "qprocess.exe",
+    "quser.exe",
+    "qwinsta.exe",
+    "reg.exe",
+    "sc.exe",
+    "systeminfo.exe",
+    "tasklist.exe",
+    "tracert.exe",
+    "whoami.exe"
+  ) and
+  process.parent.name:"wmiprvse.exe" and 
+  not (
+    process.name : "sc.exe" and process.args : "RemoteRegistry" and process.args : "start=" and 
+    process.args : ("demand", "disabled")
+  ) and
+  not process.args : "tenable_mw_scan"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Remote System Discovery
+** ID: T1018
+** Reference URL: https://attack.mitre.org/techniques/T1018/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Technique:
+** Name: Software Discovery
+** ID: T1518
+** Reference URL: https://attack.mitre.org/techniques/T1518/
+* Technique:
+** Name: System Network Configuration Discovery
+** ID: T1016
+** Reference URL: https://attack.mitre.org/techniques/T1016/
+* Sub-technique:
+** Name: Internet Connection Discovery
+** ID: T1016.001
+** Reference URL: https://attack.mitre.org/techniques/T1016/001/
+* Technique:
+** Name: Process Discovery
+** ID: T1057
+** Reference URL: https://attack.mitre.org/techniques/T1057/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-administrator-accounts.asciidoc
new file mode 100644
index 0000000000..003abf279b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-administrator-accounts.asciidoc
@@ -0,0 +1,162 @@
+[[prebuilt-rule-8-12-8-enumeration-of-administrator-accounts]]
+=== Enumeration of Administrator Accounts
+
+Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Enumeration of Administrator Accounts*
+
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Related rules*
+
+
+- AdFind Command Activity - eda499b8-a073-4e35-9733-22ec71f57f3a
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (
+      (process.name : "net.exe" or ?process.pe.original_file_name == "net.exe") or
+      ((process.name : "net1.exe" or ?process.pe.original_file_name == "net1.exe") and not process.parent.name : "net.exe")
+    ) and
+    process.args : ("group", "user", "localgroup") and
+    process.args : ("*admin*", "Domain Admins", "Remote Desktop Users", "Enterprise Admins", "Organization Management")
+    and not process.args : ("/add", "/delete")
+  ) or
+  (
+    (process.name : "wmic.exe" or ?process.pe.original_file_name == "wmic.exe") and
+    process.args : ("group", "useraccount")
+  )
+) and not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Sub-technique:
+** Name: Domain Groups
+** ID: T1069.002
+** Reference URL: https://attack.mitre.org/techniques/T1069/002/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership.asciidoc
new file mode 100644
index 0000000000..311af1a047
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership.asciidoc
@@ -0,0 +1,195 @@
+[[prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership]]
+=== Enumeration of Privileged Local Groups Membership
+
+Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+
+*Version*: 311
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Enumeration of Privileged Local Groups Membership*
+
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the enumeration of privileged local groups' membership by suspicious processes, and excludes known legitimate utilities and programs installed. Attackers can use this information to decide the next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the process, host and user involved on the event.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Security Group Management' audit policy must be configured (Success).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Account Management >
+Audit Security Group Management (Success)
+```
+
+Microsoft introduced the https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4799[event used] in this detection rule on Windows 10 and Windows Server 2016 or later operating systems.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:iam and event.action:user-member-enumerated and 
+  (
+    group.name:(*Admin* or "RemoteDesktopUsers") or
+    winlog.event_data.TargetSid:("S-1-5-32-544" or "S-1-5-32-555")
+  ) and 
+  not (
+    winlog.event_data.SubjectUserName: *$ or
+    winlog.event_data.SubjectUserSid: ("S-1-5-19" or "S-1-5-20") or 
+    winlog.event_data.CallerProcessName:("-" or 
+                                       C\:\\Windows\\System32\\VSSVC.exe or 
+                                       C\:\\Windows\\System32\\SearchIndexer.exe or 
+                                       C\:\\Windows\\System32\\CompatTelRunner.exe or 
+                                       C\:\\Windows\\System32\\oobe\\msoobe.exe or
+                                       C\:\\Windows\\System32\\net1.exe or 
+                                       C\:\\Windows\\System32\\svchost.exe or 
+                                       C\:\\Windows\\System32\\Netplwiz.exe or 
+                                       C\:\\Windows\\System32\\msiexec.exe or
+                                       C\:\\Windows\\System32\\CloudExperienceHostBroker.exe or
+                                       C\:\\Windows\\System32\\RuntimeBroker.exe or
+                                       C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe or
+                                       C\:\\Windows\\System32\\SrTasks.exe or
+                                       C\:\\Windows\\System32\\diskshadow.exe or
+                                       C\:\\Windows\\System32\\dfsrs.exe or
+                                       C\:\\Windows\\System32\\vssadmin.exe or
+                                       C\:\\Windows\\System32\\dllhost.exe or
+                                       C\:\\Windows\\System32\\mmc.exe or
+                                       C\:\\Windows\\System32\\SettingSyncHost.exe or
+                                       C\:\\Windows\\System32\\inetsrv\\w3wp.exe or
+                                       C\:\\Windows\\System32\\wsmprovhost.exe or
+                                       C\:\\Windows\\System32\\mstsc.exe or
+                                       C\:\\Windows\\System32\\esentutl.exe or
+                                       C\:\\Windows\\System32\\RecoveryDrive.exe or
+                                       C\:\\Windows\\System32\\SystemPropertiesComputerName.exe or
+                                       C\:\\Windows\\SysWOW64\\msiexec.exe or
+                                       C\:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe or
+                                       C\:\\Windows\\Temp\\rubrik_vmware*\\snaptool.exe or
+                                       C\:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe or
+                                       C\:\\WindowsAzure\\*WaAppAgent.exe or
+                                       C\:\\$WINDOWS.~BT\\Sources\\*.exe
+                                      )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell.asciidoc
new file mode 100644
index 0000000000..6e83c98639
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell]]
+=== Exchange Mailbox Export via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+* https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Exchange Mailbox Export via PowerShell*
+
+
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the export operation:
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+  - Contact the account owner and confirm whether they are aware of this activity.
+  - Check if this operation was approved and performed according to the organization's change management policy.
+  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
+- If the operation was completed successfully:
+  - Check if the file is on the path specified in the command.
+  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : "New-MailboxExportRequest"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Local System
+** ID: T1005
+** Reference URL: https://attack.mitre.org/techniques/T1005/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions.asciidoc
new file mode 100644
index 0000000000..729b69046b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions]]
+=== Executable File Creation with Multiple Extensions
+
+Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and file.extension : "exe" and
+  file.name regex~ """.*\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\.exe""" and
+  not (process.executable : ("?:\\Windows\\System32\\msiexec.exe", "C:\\Users\\*\\QGIS_SCCM\\Files\\QGIS-OSGeo4W-*-Setup-x86_64.exe") and
+       file.path : "?:\\Program Files\\QGIS *\\apps\\grass\\*.exe") and
+  not process.executable : ("/bin/sh", "/usr/sbin/MailScanner", "/usr/bin/perl")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Double File Extension
+** ID: T1036.007
+** Reference URL: https://attack.mitre.org/techniques/T1036/007/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line.asciidoc
new file mode 100644
index 0000000000..68dbbfe417
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line.asciidoc
@@ -0,0 +1,267 @@
+[[prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line]]
+=== Execution from Unusual Directory - Command Line
+
+Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Execution from Unusual Directory - Command Line*
+
+
+This rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine which commands or scripts were executed.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of parent process executable and command line conditions.
+
+
+*Related rules*
+
+
+- Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("wscript.exe",
+                  "cscript.exe",
+                  "rundll32.exe",
+                  "regsvr32.exe",
+                  "cmstp.exe",
+                  "RegAsm.exe",
+                  "installutil.exe",
+                  "mshta.exe",
+                  "RegSvcs.exe",
+                  "powershell.exe",
+                  "pwsh.exe",
+                  "cmd.exe") and
+
+  /* add suspicious execution paths here */
+  process.args : ("C:\\PerfLogs\\*",
+                  "C:\\Users\\Public\\*",
+                  "C:\\Windows\\Tasks\\*",
+                  "C:\\Intel\\*",
+                  "C:\\AMD\\Temp\\*",
+                  "C:\\Windows\\AppReadiness\\*",
+                  "C:\\Windows\\ServiceState\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\IdentityCRL\\*",
+                  "C:\\Windows\\Branding\\*",
+                  "C:\\Windows\\csc\\*",
+                  "C:\\Windows\\DigitalLocker\\*",
+                  "C:\\Windows\\en-US\\*",
+                  "C:\\Windows\\wlansvc\\*",
+                  "C:\\Windows\\Prefetch\\*",
+                  "C:\\Windows\\Fonts\\*",
+                  "C:\\Windows\\diagnostics\\*",
+                  "C:\\Windows\\TAPI\\*",
+                  "C:\\Windows\\INF\\*",
+                  "C:\\Windows\\System32\\Speech\\*",
+                  "C:\\windows\\tracing\\*",
+                  "c:\\windows\\IME\\*",
+                  "c:\\Windows\\Performance\\*",
+                  "c:\\windows\\intel\\*",
+                  "c:\\windows\\ms\\*",
+                  "C:\\Windows\\dot3svc\\*",
+                  "C:\\Windows\\panther\\*",
+                  "C:\\Windows\\RemotePackages\\*",
+                  "C:\\Windows\\OCR\\*",
+                  "C:\\Windows\\appcompat\\*",
+                  "C:\\Windows\\apppatch\\*",
+                  "C:\\Windows\\addins\\*",
+                  "C:\\Windows\\Setup\\*",
+                  "C:\\Windows\\Help\\*",
+                  "C:\\Windows\\SKB\\*",
+                  "C:\\Windows\\Vss\\*",
+                  "C:\\Windows\\servicing\\*",
+                  "C:\\Windows\\CbsTemp\\*",
+                  "C:\\Windows\\Logs\\*",
+                  "C:\\Windows\\WaaS\\*",
+                  "C:\\Windows\\twain_32\\*",
+                  "C:\\Windows\\ShellExperiences\\*",
+                  "C:\\Windows\\ShellComponents\\*",
+                  "C:\\Windows\\PLA\\*",
+                  "C:\\Windows\\Migration\\*",
+                  "C:\\Windows\\debug\\*",
+                  "C:\\Windows\\Cursors\\*",
+                  "C:\\Windows\\Containers\\*",
+                  "C:\\Windows\\Boot\\*",
+                  "C:\\Windows\\bcastdvr\\*",
+                  "C:\\Windows\\TextInput\\*",
+                  "C:\\Windows\\security\\*",
+                  "C:\\Windows\\schemas\\*",
+                  "C:\\Windows\\SchCache\\*",
+                  "C:\\Windows\\Resources\\*",
+                  "C:\\Windows\\rescache\\*",
+                  "C:\\Windows\\Provisioning\\*",
+                  "C:\\Windows\\PrintDialog\\*",
+                  "C:\\Windows\\PolicyDefinitions\\*",
+                  "C:\\Windows\\media\\*",
+                  "C:\\Windows\\Globalization\\*",
+                  "C:\\Windows\\L2Schemas\\*",
+                  "C:\\Windows\\LiveKernelReports\\*",
+                  "C:\\Windows\\ModemLogs\\*",
+                  "C:\\Windows\\ImmersiveControlPanel\\*",
+                  "C:\\$Recycle.Bin\\*") and
+
+  /* noisy FP patterns */
+
+  not process.parent.executable : ("C:\\WINDOWS\\System32\\DriverStore\\FileRepository\\*\\igfxCUIService*.exe",
+                                   "C:\\Windows\\System32\\spacedeskService.exe",
+                                   "C:\\Program Files\\Dell\\SupportAssistAgent\\SRE\\SRE.exe") and
+  not (process.name : "rundll32.exe" and
+       process.args : ("uxtheme.dll,#64",
+                       "PRINTUI.DLL,PrintUIEntry",
+                       "?:\\Windows\\System32\\FirewallControlPanel.dll,ShowNotificationDialog",
+                       "?:\\WINDOWS\\system32\\Speech\\SpeechUX\\sapi.cpl",
+                       "?:\\Windows\\system32\\shell32.dll,OpenAs_RunDLL")) and
+
+  not (process.name : "cscript.exe" and process.args : "?:\\WINDOWS\\system32\\calluxxprovider.vbs") and
+
+  not (process.name : "cmd.exe" and process.args : "?:\\WINDOWS\\system32\\powercfg.exe" and process.args : "?:\\WINDOWS\\inf\\PowerPlan.log") and
+
+  not (process.name : "regsvr32.exe" and process.args : "?:\\Windows\\Help\\OEM\\scripts\\checkmui.dll") and
+
+  not (process.name : "cmd.exe" and
+       process.parent.executable : ("?:\\Windows\\System32\\oobe\\windeploy.exe",
+                                    "?:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe",
+                                    "?:\\Windows\\System32\\igfxCUIService.exe",
+                                    "?:\\Windows\\Temp\\IE*.tmp\\IE*-support\\ienrcore.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard.asciidoc
new file mode 100644
index 0000000000..718ac220a5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard]]
+=== Execution of COM object via Xwizard
+
+Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
+* http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "xwizard.exe" or ?process.pe.original_file_name : "xwizard.exe") and
+ (
+   (process.args : "RunWizard" and process.args : "{*}") or
+   (process.executable != null and
+     not process.executable : ("C:\\Windows\\SysWOW64\\xwizard.exe", "C:\\Windows\\System32\\xwizard.exe")
+   )
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program.asciidoc
new file mode 100644
index 0000000000..8ee6eb095d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program.asciidoc
@@ -0,0 +1,85 @@
+[[prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program]]
+=== Execution of Persistent Suspicious Program
+
+Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* userinit followed by explorer followed by early child process of explorer (unlikely to be launched interactively) within 1m */
+sequence by host.id, user.name with maxspan=1m
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "userinit.exe" and process.parent.name : "winlogon.exe"]
+  [process where host.os.type == "windows" and event.type == "start" and process.name : "explorer.exe"]
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "explorer.exe" and
+   /* add suspicious programs here */
+   process.pe.original_file_name in ("cscript.exe",
+                                     "wscript.exe",
+                                     "PowerShell.EXE",
+                                     "MSHTA.EXE",
+                                     "RUNDLL32.EXE",
+                                     "REGSVR32.EXE",
+                                     "RegAsm.exe",
+                                     "MSBuild.exe",
+                                     "InstallUtil.exe") and
+    /* add potential suspicious paths here */
+    process.args : ("C:\\Users\\*", "C:\\ProgramData\\*", "C:\\Windows\\Temp\\*", "C:\\Windows\\Tasks\\*", "C:\\PerfLogs\\*", "C:\\Intel\\*")
+   ]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module.asciidoc
new file mode 100644
index 0000000000..ce0155ba6a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module.asciidoc
@@ -0,0 +1,90 @@
+[[prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module]]
+=== Execution via local SxS Shared Module
+
+Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+The SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and file.extension : "dll" and file.path : "C:\\*\\*.exe.local\\*.dll"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Shared Modules
+** ID: T1129
+** Reference URL: https://attack.mitre.org/techniques/T1129/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
new file mode 100644
index 0000000000..a494789252
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure]]
+=== Execution via MSSQL xp_cmdshell Stored Procedure
+
+Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Execution via MSSQL xp_cmdshell Stored Procedure*
+
+
+Microsoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.
+
+The xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server service account, which is often privileged.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line to determine if the command executed is potentially harmful or malicious.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of it. If recurrent tasks are being executed using this mechanism, consider adding exceptions — preferably with a full command line.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Ensure that SQL servers are not directly exposed to the internet. If there is a business justification for such, use an allowlist to allow only connections from known legitimate sources.
+- Disable the xp_cmdshell stored procedure.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.parent.name : "sqlservr.exe" and 
+  (
+   (process.name : "cmd.exe" and 
+    not process.args : ("\\\\*", "diskfree", "rmdir", "mkdir", "dir", "del", "rename", "bcp", "*XMLNAMESPACES*", 
+                        "?:\\MSSQL\\Backup\\Jobs\\sql_agent_backup_job.ps1", "K:\\MSSQL\\Backup\\msdb", "K:\\MSSQL\\Backup\\Logins")) or 
+                        
+   (process.name : "vpnbridge.exe" or ?process.pe.original_file_name : "vpnbridge.exe") or 
+
+   (process.name : "certutil.exe" or ?process.pe.original_file_name == "CertUtil.exe") or 
+
+   (process.name : "bitsadmin.exe" or ?process.pe.original_file_name == "bitsadmin.exe")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: SQL Stored Procedures
+** ID: T1505.001
+** Reference URL: https://attack.mitre.org/techniques/T1505/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint.asciidoc
new file mode 100644
index 0000000000..8d139325fe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint.asciidoc
@@ -0,0 +1,84 @@
+[[prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint]]
+=== Execution via TSClient Mountpoint
+
+Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.executable : "\\Device\\Mup\\tsclient\\*.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux.asciidoc
new file mode 100644
index 0000000000..374240a5eb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux.asciidoc
@@ -0,0 +1,76 @@
+[[prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux]]
+=== Execution via Windows Subsystem for Linux
+
+Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+  process.parent.name : ("wsl.exe", "wslhost.exe") and
+  not process.executable : (
+        "?:\\Program Files (x86)\\*",
+        "?:\\Program Files\\*",
+        "?:\\Program Files*\\WindowsApps\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\wsl*.exe",
+        "?:\\Windows\\System32\\conhost.exe",
+        "?:\\Windows\\System32\\lxss\\wslhost.exe",
+        "?:\\Windows\\System32\\WerFault.exe",
+        "?:\\Windows\\Sys*\\wslconfig.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded.asciidoc
new file mode 100644
index 0000000000..3a79efc50c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded.asciidoc
@@ -0,0 +1,75 @@
+[[prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded]]
+=== Expired or Revoked Driver Loaded
+
+Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "windows" and process.pid == 4 and
+  dll.code_signature.status : ("errorExpired", "errorRevoked")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell.asciidoc
new file mode 100644
index 0000000000..60d7891c51
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell.asciidoc
@@ -0,0 +1,160 @@
+[[prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell]]
+=== Exporting Exchange Mailbox via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Exporting Exchange Mailbox via PowerShell*
+
+
+Email mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.
+
+The `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.
+
+Attackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the export operation:
+  - Identify the user account that performed the action and whether it should perform this kind of action.
+  - Contact the account owner and confirm whether they are aware of this activity.
+  - Check if this operation was approved and performed according to the organization's change management policy.
+  - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.
+  - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the "Mailbox Import Export" privilege for abnormal activity.
+- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.
+- If the operation was completed successfully:
+  - Check if the file is on the path specified in the command.
+  - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.
+- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.
+- Prioritize cases that involve personally identifiable information (PII) or other classified data.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges of users with the "Mailbox Import Export" privilege to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and 
+  process.command_line : ("*MailboxExportRequest*", "*-Mailbox*-ContentFilter*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Local System
+** ID: T1005
+** Reference URL: https://attack.mitre.org/techniques/T1005/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Remote Email Collection
+** ID: T1114.002
+** Reference URL: https://attack.mitre.org/techniques/T1114/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
new file mode 100644
index 0000000000..f886f77687
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -0,0 +1,310 @@
+[[prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution]]
+=== First Time Seen Commonly Abused Remote Access Tool Execution
+
+Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* endgame-*
+* winlogbeat-*
+* logs-windows.*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/
+* https://attack.mitre.org/techniques/T1219/
+* https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen Commonly Abused Remote Access Tool Execution*
+
+
+Remote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.
+
+At the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.
+
+This rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Check if the execution of the remote access tool is approved by the organization's IT department.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Contact the account owner and confirm whether they are aware of this activity.
+  - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+
+
+*False positive analysis*
+
+
+- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.
+- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type: "windows" and
+
+   event.category: "process" and event.type : "start" and
+
+    (
+        process.code_signature.subject_name : (
+            "Action1 Corporation" or
+            "AeroAdmin LLC" or
+            "Ammyy LLC" or
+            "Atera Networks Ltd" or
+            "AWERAY PTE. LTD." or
+            "BeamYourScreen GmbH" or
+            "Bomgar Corporation" or
+            "DUC FABULOUS CO.,LTD" or
+            "DOMOTZ INC." or
+            "DWSNET OÜ" or
+            "FleetDeck Inc" or
+            "GlavSoft LLC" or
+            "GlavSoft LLC." or
+            "Hefei Pingbo Network Technology Co. Ltd" or
+            "IDrive, Inc." or
+            "IMPERO SOLUTIONS LIMITED" or
+            "Instant Housecall" or
+            "ISL Online Ltd." or
+            "LogMeIn, Inc." or
+            "Monitoring Client" or
+            "MMSOFT Design Ltd." or
+            "Nanosystems S.r.l." or
+            "NetSupport Ltd" or
+            "NinjaRMM, LLC" or
+            "Parallels International GmbH" or
+            "philandro Software GmbH" or
+            "Pro Softnet Corporation" or
+            "RealVNC" or
+            "RealVNC Limited" or
+            "BreakingSecurity.net" or
+            "Remote Utilities LLC" or
+            "Rocket Software, Inc." or
+            "SAFIB" or
+            "Servably, Inc." or
+            "ShowMyPC INC" or
+            "Splashtop Inc." or
+            "Superops Inc." or
+            "TeamViewer" or
+            "TeamViewer GmbH" or
+            "TeamViewer Germany GmbH" or
+            "Techinline Limited" or
+            "uvnc bvba" or
+            "Yakhnovets Denis Aleksandrovich IP" or
+            "Zhou Huabing"
+        ) or
+
+        process.name.caseless : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        ) or
+        process.name : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        )
+	) and
+
+	not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-driver-loaded.asciidoc
new file mode 100644
index 0000000000..087802e53e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-driver-loaded.asciidoc
@@ -0,0 +1,153 @@
+[[prebuilt-rule-8-12-8-first-time-seen-driver-loaded]]
+=== First Time Seen Driver Loaded
+
+Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating First Time Seen Driver Loaded*
+
+
+A driver is a software component that allows the operating system to communicate with hardware devices. It works at a high privilege level, the kernel level, having high control over the system's security and stability.
+
+Attackers may exploit known good but vulnerable drivers to execute code in their context because once an attacker can execute code in the kernel, security tools can no longer effectively protect the host. They can leverage these drivers to tamper, bypass and terminate security software, elevate privileges, create persistence mechanisms, and disable operating system protections and monitoring features. Attackers were seen in the wild conducting these actions before acting on their objectives, such as ransomware.
+
+Read the complete research on "Stopping Vulnerable Driver Attacks" done by Elastic Security Labs https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks[here].
+
+This rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
+  - Identify the path that the driver was loaded from. If using Elastic Defend, this information can be found in the `dll.path` field.
+  - Examine the digital signature of the driver, and check if it's valid.
+  - Examine the creation and modification timestamps of the file:
+    - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `"dll.Ext.relative_file_name_modify_time"` fields, with the values being seconds.
+    - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.
+      - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+  - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Use Osquery to investigate the drivers loaded into the system.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+
+*False positive analysis*
+
+
+- Matches derived from these rules are not inherently malicious. The security team should investigate them to ensure they are legitimate and needed, then include them in an allowlist only if required. The security team should address any vulnerable driver installation as it can put the user and the domain at risk.
+
+
+*Related Rules*
+
+
+- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"driver" and host.os.type:windows and event.action:"load"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-removable-device.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-removable-device.asciidoc
new file mode 100644
index 0000000000..f6c34a7c0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-first-time-seen-removable-device.asciidoc
@@ -0,0 +1,80 @@
+[[prebuilt-rule-8-12-8-first-time-seen-removable-device]]
+=== First Time Seen Removable Device
+
+Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html
+* https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Exfiltration
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:"registry" and host.os.type:"windows" and registry.value:"FriendlyName" and registry.path:*USBSTOR*
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Replication Through Removable Media
+** ID: T1091
+** Reference URL: https://attack.mitre.org/techniques/T1091/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Physical Medium
+** ID: T1052
+** Reference URL: https://attack.mitre.org/techniques/T1052/
+* Sub-technique:
+** Name: Exfiltration over USB
+** ID: T1052.001
+** Reference URL: https://attack.mitre.org/techniques/T1052/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide.asciidoc
new file mode 100644
index 0000000000..10dac47b37
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide.asciidoc
@@ -0,0 +1,86 @@
+[[prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide]]
+=== Full User-Mode Dumps Enabled System-Wide
+
+Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
+* https://github.com/deepinstinct/Lsass-Shtinkering
+* https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Elastic Endgame
+* Data Source: Sysmon
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+    registry.path : (
+        "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType",
+        "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\LocalDumps\\DumpType"
+    ) and
+    registry.data.strings : ("2", "0x00000002") and
+    not (process.executable : "?:\\Windows\\system32\\svchost.exe" and user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
new file mode 100644
index 0000000000..b927cae610
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility]]
+=== Group Policy Discovery via Microsoft GPResult Utility
+
+Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Group Policy Discovery via Microsoft GPResult Utility*
+
+
+Group Policy is a Windows feature that allows administrators to manage and configure settings for users and computers in an Active Directory environment. The Microsoft GPResult utility (gpresult.exe) is a command-line tool used to query and display Group Policy Objects (GPOs) applied to a system. Attackers may abuse this utility to gain insights into the active directory environment and identify potential privilege escalation or lateral movement opportunities.
+
+The detection rule 'Group Policy Discovery via Microsoft GPResult Utility' is designed to identify the usage of gpresult.exe with specific arguments ("/z", "/v", "/r", "/x") that are commonly used by adversaries during the reconnaissance phase to perform group policy discovery.
+
+
+*Possible investigation steps*
+
+
+- Review the alert details to understand the context of the gpresult.exe usage, such as the user account, system, and time of execution.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Investigate any abnormal behavior by the parent process, such as network connections, registry or file modifications, and any other spawned child processes.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(process.name: "gpresult.exe" or ?process.pe.original_file_name == "gprslt.exe") and process.args: ("/z", "/v", "/r", "/x")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Group Policy Discovery
+** ID: T1615
+** Reference URL: https://attack.mitre.org/techniques/T1615/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations.asciidoc
new file mode 100644
index 0000000000..b5b5f9d8d0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations.asciidoc
@@ -0,0 +1,114 @@
+[[prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations]]
+=== High Number of Process and/or Service Terminations
+
+This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period.
+
+*Rule type*: threshold
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/luna-ransomware-attack-pattern
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating High Number of Process and/or Service Terminations*
+
+
+Attackers can stop services and kill processes for a variety of purposes. For example, they can stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted, or stop security and backup solutions, etc.
+
+This rule identifies a high number (10) of service and/or process terminations (stop, delete, or suspend) from the same host within a short time period.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if any files on the host machine have been encrypted.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system or restore it to the operational state.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and
+ process.args:(stop or pause or delete or "/PID" or "/IM" or "/T" or "/F" or "/t" or "/f" or "/im" or "/pid") and
+ not process.parent.name:osquerybeat.exe
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Service Stop
+** ID: T1489
+** Reference URL: https://attack.mitre.org/techniques/T1489/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-iis-http-logging-disabled.asciidoc
new file mode 100644
index 0000000000..2d6ea17c88
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-iis-http-logging-disabled.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-12-8-iis-http-logging-disabled]]
+=== IIS HTTP Logging Disabled
+
+Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating IIS HTTP Logging Disabled*
+
+
+IIS (Internet Information Services) is a Microsoft web server software used to host websites and web applications on Windows. It provides features for serving dynamic and static content, and can be managed through a graphical interface or command-line tools.
+
+IIS logging is a data source that can be used for security monitoring, forensics, and incident response. It contains mainly information related to requests done to the web server, and can be used to spot malicious activities like webshells. Adversaries can tamper, clear, and delete this data to evade detection, cover their tracks, and slow down incident response.
+
+This rule monitors commands that disable IIS logging.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - Verify if any other anti-forensics behaviors were observed.
+- Verify whether the logs stored in the `C:\inetpub\logs\logfiles\w3svc1` directory were deleted after this action.
+- Check if this operation is done under change management and approved according to the organization's policy.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Re-enable affected logging components, services, and security monitoring.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "appcmd.exe" or ?process.pe.original_file_name == "appcmd.exe") and
+  process.args : "/dontLog*:*True" and
+  not process.parent.name : "iissetup.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-image-file-execution-options-injection.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-image-file-execution-options-injection.asciidoc
new file mode 100644
index 0000000000..676895237f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-image-file-execution-options-injection.asciidoc
@@ -0,0 +1,90 @@
+[[prebuilt-rule-8-12-8-image-file-execution-options-injection]]
+=== Image File Execution Options Injection
+
+The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and length(registry.data.strings) > 0 and
+  registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
+    "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*.exe\\Debugger",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\Debugger",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\*\\MonitorProcess"
+  ) and
+    /* add FPs here */
+  not registry.data.strings regex~ ("""C:\\Program Files( \(x86\))?\\ThinKiosk\\thinkiosk\.exe""", """.*\\PSAppDeployToolkit\\.*""")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client.asciidoc
new file mode 100644
index 0000000000..0ae562e102
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client.asciidoc
@@ -0,0 +1,151 @@
+[[prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client]]
+=== ImageLoad via Windows Update Auto Update Client
+
+Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://dtm.uk/wuauclt/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating ImageLoad via Windows Update Auto Update Client*
+
+
+The Windows Update Auto Update Client (wuauclt.exe) is the component responsible for managing system updates. However, adversaries may abuse this process to load a malicious DLL and execute malicious code while blending into a legitimate system mechanism. 
+
+This rule identifies potential abuse for code execution by monitoring for specific process arguments ("/RunHandlerComServer" and "/UpdateDeploymentProvider") and common writable paths where the target DLL can be placed (e.g., "C:\Users\*.dll", "C:\ProgramData\*.dll", etc.).
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line and identify the DLL location.
+- Examine whether the DLL is signed.
+- Retrieve the DLL and determine if it is malicious:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate the behavior of child processes, such as network connections, registry or file modifications, and any spawned processes.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (?process.pe.original_file_name == "wuauclt.exe" or process.name : "wuauclt.exe") and
+   /* necessary windows update client args to load a dll */
+   process.args : "/RunHandlerComServer" and process.args : "/UpdateDeploymentProvider" and
+   /* common paths writeable by a standard user where the target DLL can be placed */
+   process.args : ("C:\\Users\\*.dll", "C:\\ProgramData\\*.dll", "C:\\Windows\\Temp\\*.dll", "C:\\Windows\\Tasks\\*.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits.asciidoc
new file mode 100644
index 0000000000..86fd78b26e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits]]
+=== Ingress Transfer via Windows BITS
+
+Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://attack.mitre.org/techniques/T1197/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Command and Control
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Ingress Transfer via Windows BITS*
+
+
+Windows Background Intelligent Transfer Service (BITS) is a technology that allows the transfer of files between a client and a server, which makes it a dual-use mechanism, being used by both legitimate apps and attackers. When malicious applications create BITS jobs, files are downloaded or uploaded in the context of the service host process, which can bypass security protections, and it helps to obscure which application requested the transfer.
+
+This rule identifies such abuse by monitoring for file renaming events involving "svchost.exe" and "BIT*.tmp" on Windows systems.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Gain context into the BITS transfer.
+  - Try to determine the process that initiated the BITS transfer.
+    - Search `bitsadmin.exe` processes and examine their command lines.
+    - Look for unusual processes loading `Bitsproxy.dll` and other BITS-related DLLs.
+  - Try to determine the origin of the file.
+    - Inspect network connections initiated by `svchost.exe`.
+    - Inspect `Microsoft-Windows-Bits-Client/Operational` Windows logs, specifically the event ID 59, for unusual events.
+      - Velociraptor can be used to extract these entries using the https://docs.velociraptor.app/exchange/artifacts/pages/bitsadmin/[bitsadmin artifact].
+    - Check the reputation of the remote server involved in the BITS transfer, such as its IP address or domain, using threat intelligence platforms or online reputation services.
+    - Check if the domain is newly registered or unexpected.
+    - Use the identified domain as an indicator of compromise (IoCs) to scope other compromised hosts in the environment.
+  - https://github.com/fireeye/BitsParser[BitsParser] can be used to parse BITS database files to extract BITS job information.
+- Examine the details of the dropped file, and whether it was executed.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the involved executables using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+
+*False positive analysis*
+
+
+- Known false positives for the rule include legitimate software and system updates that use BITS for downloading files.
+
+
+*Related Rules*
+
+
+- Persistence via BITS Job Notify Cmdline - c3b915e0-22f3-4bf7-991d-b643513c722f
+- Unsigned BITS Service Client Process - 9a3884d0-282d-45ea-86ce-b9c81100f026
+- Bitsadmin Activity - 8eec4df1-4b4b-4502-b6c3-c788714604c9
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restore the affected system to its operational state by applying any necessary patches, updates, or configuration changes.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.action == "rename" and
+  process.name : "svchost.exe" and file.Ext.original.name : "BIT*.tmp" and 
+  (file.extension : ("exe", "zip", "rar", "bat", "dll", "ps1", "vbs", "wsh", "js", "vbe", "pif", "scr", "cmd", "cpl") or
+   file.Ext.header_bytes : "4d5a*") and 
+ 
+  /* noisy paths, for hunting purposes you can use the same query without the following exclusions */
+  not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", "?:\\Windows\\*", "?:\\ProgramData\\*\\*") and 
+ 
+  /* lot of third party SW use BITS to download executables with a long file name */
+  not length(file.name) > 30 and
+  not file.path : (
+        "?:\\Users\\*\\AppData\\Local\\Temp*\\wct*.tmp",
+        "?:\\Users\\*\\AppData\\Local\\Adobe\\ARM\\*\\RdrServicesUpdater*.exe",
+        "?:\\Users\\*\\AppData\\Local\\Adobe\\ARM\\*\\AcroServicesUpdater2_x64.exe",
+        "?:\\Users\\*\\AppData\\Local\\Docker Desktop Installer\\update-*.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: BITS Jobs
+** ID: T1197
+** Reference URL: https://attack.mitre.org/techniques/T1197/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-custom-shim-databases.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-custom-shim-databases.asciidoc
new file mode 100644
index 0000000000..1bc3de7210
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-custom-shim-databases.asciidoc
@@ -0,0 +1,73 @@
+[[prebuilt-rule-8-12-8-installation-of-custom-shim-databases]]
+=== Installation of Custom Shim Databases
+
+Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+    registry.path : "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Custom\\*.sdb" and 
+    not process.executable : 
+                       ("?:\\Program Files (x86)\\DesktopCentral_Agent\\swrepository\\1\\swuploads\\SAP-SLC\\SAPSetupSLC02_14-80001954\\Setup\\NwSapSetup.exe", 
+                        "?:\\$WINDOWS.~BT\\Sources\\SetupPlatform.exe", 
+                         "?:\\Program Files (x86)\\SAP\\SAPsetup\\setup\\NwSapSetup.exe", 
+                         "?:\\Program Files (x86)\\SAP\\SapSetup\\OnRebootSvc\\NWSAPSetupOnRebootInstSvc.exe", 
+                         "?:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Security for Windows Server\\kavfs.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-security-support-provider.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-security-support-provider.asciidoc
new file mode 100644
index 0000000000..1db1354019
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-installation-of-security-support-provider.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-8-installation-of-security-support-provider]]
+=== Installation of Security Support Provider
+
+Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+   registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages*"
+   ) and
+   not process.executable : ("C:\\Windows\\System32\\msiexec.exe", "C:\\Windows\\SysWOW64\\msiexec.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Security Support Provider
+** ID: T1547.005
+** Reference URL: https://attack.mitre.org/techniques/T1547/005/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process.asciidoc
new file mode 100644
index 0000000000..e2188ed918
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process.asciidoc
@@ -0,0 +1,188 @@
+[[prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process]]
+=== Kerberos Traffic from Unusual Process
+
+Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Kerberos Traffic from Unusual Process*
+
+
+Kerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.
+
+Domain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if the Destination IP is related to a Domain Controller.
+- Review event ID 4769 for suspicious ticket requests.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This rule uses a Kerberos-related port but does not identify the protocol used on that port. HTTP traffic on a non-standard port or destination IP address unrelated to Domain controllers can create false positives.
+- Exceptions can be added for noisy/frequent connections.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+  - Ticket requests can be used to investigate potentially compromised accounts.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and event.type == "start" and network.direction == "egress" and
+  destination.port == 88 and source.port >= 49152 and process.pid != 4 and destination.address : "*" and
+  not 
+  (
+    process.executable : (
+        "\\device\\harddiskvolume?\\program files (x86)\\nmap\\nmap.exe",
+        "\\device\\harddiskvolume?\\program files (x86)\\nmap oem\\nmap.exe",
+        "\\device\\harddiskvolume?\\windows\\system32\\lsass.exe",
+        "?:\\Program Files\\Amazon Corretto\\jdk1*\\bin\\java.exe",
+        "?:\\Program Files\\BlackBerry\\UEM\\Proxy Server\\bin\\prunsrv.exe",
+        "?:\\Program Files\\BlackBerry\\UEM\\Core\\tomcat-core\\bin\\tomcat9.exe",
+        "?:\\Program Files\\DBeaver\\dbeaver.exe",
+        "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.backend.exe",
+        "?:\\Program Files\\Docker\\Docker\\resources\\com.docker.vpnkit.exe",
+        "?:\\Program Files\\Docker\\Docker\\resources\\vpnkit.exe",
+        "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+        "?:\\Program Files\\Internet Explorer\\iexplore.exe",
+        "?:\\Program Files\\JetBrains\\PyCharm Community Edition*\\bin\\pycharm64.exe",
+        "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+        "?:\\Program Files\\Oracle\\VirtualBox\\VirtualBoxVM.exe",
+        "?:\\Program Files\\Puppet Labs\\Puppet\\puppet\\bin\\ruby.exe",
+        "?:\\Program Files\\rapid7\\nexpose\\nse\\.DLLCACHE\\nseserv.exe",
+        "?:\\Program Files\\Silverfort\\Silverfort AD Adapter\\SilverfortServer.exe",
+        "?:\\Program Files\\Tenable\\Nessus\\nessusd.exe",
+        "?:\\Program Files\\VMware\\VMware View\\Server\\bin\\ws_TomcatService.exe",
+        "?:\\Program Files (x86)\\Advanced Port Scanner\\advanced_port_scanner.exe",
+        "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcpatchscan.exe",
+        "?:\\Program Files (x86)\\GFI\\LanGuard 12 Agent\\lnsscomm.exe",
+        "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+        "?:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
+        "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+        "?:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
+        "?:\\Program Files (x86)\\Microsoft Silverlight\\sllauncher.exe",
+        "?:\\Program Files (x86)\\Nmap\\nmap.exe",
+        "?:\\Program Files (x86)\\Nmap OEM\\nmap.exe",
+        "?:\\Program Files (x86)\\nwps\\NetScanTools Pro\\NSTPRO.exe",
+        "?:\\Program Files (x86)\\SAP BusinessObjects\\tomcat\\bin\\tomcat9.exe",
+        "?:\\Program Files (x86)\\SuperScan\\scanner.exe",
+        "?:\\Program Files (x86)\\Zscaler\\ZSATunnel\\ZSATunnel.exe",
+        "?:\\Windows\\System32\\lsass.exe",
+        "?:\\Windows\\System32\\MicrosoftEdgeCP.exe",
+        "?:\\Windows\\System32\\svchost.exe",
+        "?:\\Windows\\SysWOW64\\vmnat.exe",
+        "?:\\Windows\\SystemApps\\Microsoft.MicrosoftEdge_*\\MicrosoftEdge.exe",
+        "System"
+    ) and process.code_signature.trusted == true
+  ) and
+ destination.address != "127.0.0.1" and destination.address != "::1"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kirbi-file-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kirbi-file-creation.asciidoc
new file mode 100644
index 0000000000..074fd7e263
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-kirbi-file-creation.asciidoc
@@ -0,0 +1,65 @@
+[[prebuilt-rule-8-12-8-kirbi-file-creation]]
+=== Kirbi File Creation
+
+Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 60m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and file.extension : "kirbi"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Steal or Forge Kerberos Tickets
+** ID: T1558
+** Reference URL: https://attack.mitre.org/techniques/T1558/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lateral-movement-via-startup-folder.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lateral-movement-via-startup-folder.asciidoc
new file mode 100644
index 0000000000..9fc47893d7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lateral-movement-via-startup-folder.asciidoc
@@ -0,0 +1,102 @@
+[[prebuilt-rule-8-12-8-lateral-movement-via-startup-folder]]
+=== Lateral Movement via Startup Folder
+
+Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mdsec.co.uk/2017/06/rdpinception/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type in ("creation", "change") and
+
+ /* via RDP TSClient mounted share or SMB */
+  (process.name : "mstsc.exe" or process.pid == 4) and
+
+   file.path : ("?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+                "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled.asciidoc
new file mode 100644
index 0000000000..8026387508
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled.asciidoc
@@ -0,0 +1,88 @@
+[[prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled]]
+=== Local Account TokenFilter Policy Disabled
+
+Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2014-04-02/finding/V-36439
+* https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
+* https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+  "HKLM\\*\\LocalAccountTokenFilterPolicy",
+  "\\REGISTRY\\MACHINE\\*\\LocalAccountTokenFilterPolicy") and
+  registry.data.strings : ("1", "0x00000001")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Pass the Hash
+** ID: T1550.002
+** Reference URL: https://attack.mitre.org/techniques/T1550/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-scheduled-task-creation.asciidoc
new file mode 100644
index 0000000000..336088891c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-local-scheduled-task-creation.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-12-8-local-scheduled-task-creation]]
+=== Local Scheduled Task Creation
+
+Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-2
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+  [process where host.os.type == "windows" and event.type != "end" and
+    ((process.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
+                      "powershell.exe", "pwsh.exe", "powershell_ise.exe", "WmiPrvSe.exe", "wsmprovhost.exe", "winrshost.exe") or
+    process.pe.original_file_name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "mshta.exe",
+                                     "powershell.exe", "pwsh.dll", "powershell_ise.exe", "WmiPrvSe.exe", "wsmprovhost.exe",
+                                     "winrshost.exe")) or
+    ?process.code_signature.trusted == false)] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and
+    (process.name : "schtasks.exe" or process.pe.original_file_name == "schtasks.exe") and
+    process.args : ("/create", "-create") and process.args : ("/RU", "/SC", "/TN", "/TR", "/F", "/XML") and
+    /* exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM user */
+    not (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System")
+  ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-memory-dump-creation.asciidoc
new file mode 100644
index 0000000000..90d9d84235
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-memory-dump-creation.asciidoc
@@ -0,0 +1,172 @@
+[[prebuilt-rule-8-12-8-lsass-memory-dump-creation]]
+=== LSASS Memory Dump Creation
+
+Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/outflanknl/Dumpert
+* https://github.com/hoangprod/AndrewSpecial
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating LSASS Memory Dump Creation*
+
+
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
+
+This rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the process responsible for creating the dump file.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.action != "deletion" and
+  file.name : ("lsass*.dmp", "dumpert.dmp", "Andrew.dmp", "SQLDmpr*.mdmp", "Coredump.dmp") and
+
+  not (
+        process.executable : (
+          "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\SqlDumper.exe",
+          "?:\\Windows\\System32\\dllhost.exe"
+        ) and
+        file.path : (
+          "?:\\*\\Reporting Services\\Logfiles\\SQLDmpr*.mdmp",
+          "?:\\Program Files\\Microsoft SQL Server\\*\\Shared\\ErrorDumps\\SQLDmpr*.mdmp",
+          "?:\\Program Files\\Microsoft SQL Server\\*\\MSSQL\\LOG\\SQLDmpr*.mdmp"
+        )
+      ) and
+
+  not (
+        process.executable : "?:\\Windows\\system32\\WerFault.exe" and
+        file.path : (
+          "?:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\lsass.exe.*.dmp",
+          "?:\\Windows\\System32\\%LOCALAPPDATA%\\CrashDumps\\lsass.exe.*.dmp"
+        )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-process-access-via-windows-api.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-process-access-via-windows-api.asciidoc
new file mode 100644
index 0000000000..7c9ed1b563
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-lsass-process-access-via-windows-api.asciidoc
@@ -0,0 +1,195 @@
+[[prebuilt-rule-8-12-8-lsass-process-access-via-windows-api]]
+=== LSASS Process Access via Windows API
+
+Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.api-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating LSASS Process Access via Windows API*
+
+
+The Local Security Authority Subsystem Service (LSASS) is a critical Windows component responsible for managing user authentication and security policies. Adversaries may attempt to access the LSASS handle to dump credentials from its memory, which can be used for lateral movement and privilege escalation.
+
+This rule identifies attempts to access LSASS by monitoring for specific API calls (OpenProcess, OpenThread) targeting the "lsass.exe" process.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the process execution chain (parent process tree) of the process that accessed the LSASS handle.
+  - Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Determine the first time the process executable was seen in the environment and if this behavior happened in the past.
+  - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+  - Investigate any abnormal behavior by the subject process, such as network connections, DLLs loaded, registry or file modifications, and any spawned child processes.
+- Assess the access rights (`process.Ext.api.parameters.desired_access`field) requested by the process. This https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights[Microsoft documentation] may be useful to help the interpretation.
+- If there are traces of LSASS memory being successfully dumped, investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the executables of the processes using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+
+*False positive analysis*
+
+
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of `process.executable`, `process.code_signature.subject_name` and `process.Ext.api.parameters.desired_access_numeric` conditions.
+
+
+*Related Rules*
+
+
+- Suspicious Lsass Process Access - 128468bf-cab1-4637-99ea-fdf3780a4609
+- Potential Credential Access via DuplicateHandle in LSASS - 02a4576a-7480-4284-9327-548a806b5e48
+- LSASS Memory Dump Handle Access - 208dbe77-01ed-4954-8d44-1e5751cb20de
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+api where host.os.type == "windows" and 
+  process.Ext.api.name in ("OpenProcess", "OpenThread") and Target.process.name : "lsass.exe" and 
+  not 
+  (
+    process.executable : (
+        "?:\\ProgramData\\GetSupportService*\\Updates\\Update_*.exe",
+        "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+        "?:\\Program Files (x86)\\Asiainfo Security\\OfficeScan Client\\NTRTScan.exe",
+        "?:\\Program Files (x86)\\Blackpoint\\SnapAgent\\SnapAgent.exe",
+        "?:\\Program Files (x86)\\eScan\\reload.exe",
+        "?:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe",
+        "?:\\Program Files (x86)\\Kaspersky Lab\\*\\avp.exe",
+        "?:\\Program Files (x86)\\N-able Technologies\\Reactive\\bin\\NableReactiveManagement.exe",
+        "?:\\Program Files (x86)\\N-able Technologies\\Windows Agent\\bin\\agent.exe",
+        "?:\\Program Files (x86)\\Trend Micro\\*\\CCSF\\TmCCSF.exe",
+        "?:\\Program Files*\\Windows Defender\\MsMpEng.exe",
+        "?:\\Program Files\\Bitdefender\\Endpoint Security\\EPSecurityService.exe",
+        "?:\\Program Files\\Cisco\\AMP\\*\\sfc.exe",
+        "?:\\Program Files\\Common Files\\McAfee\\AVSolution\\mcshield.exe",
+        "?:\\Program Files\\EA\\AC\\EAAntiCheat.GameService.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\metricbeat.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\osqueryd.exe",
+        "?:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-*\\components\\packetbeat.exe",
+        "?:\\Program Files\\ESET\\ESET Security\\ekrn.exe",
+        "?:\\Program Files\\Fortinet\\FortiClient\\FortiProxy.exe",
+        "?:\\Program Files\\Huntress\\HuntressAgent.exe",
+        "?:\\Program Files\\LogicMonitor\\Agent\\bin\\sbshutdown.exe",
+        "?:\\Program Files\\Microsoft Security Client\\MsMpEng.exe",
+        "?:\\Program Files\\Qualys\\QualysAgent\\QualysAgent.exe",
+        "?:\\Program Files\\TDAgent\\ossec-agent\\ossec-agent.exe",
+        "?:\\Program Files\\Topaz OFD\\Warsaw\\core.exe",
+        "?:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
+        "?:\\Windows\\AdminArsenal\\PDQDeployRunner\\*\\exec\\Sysmon64.exe",
+        "?:\\Windows\\Sysmon.exe",
+        "?:\\Windows\\Sysmon64.exe",
+        "?:\\Windows\\System32\\csrss.exe",
+        "?:\\Windows\\System32\\MRT.exe",
+        "?:\\Windows\\System32\\msiexec.exe",
+        "?:\\Windows\\System32\\RtkAudUService64.exe",
+        "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
+        "?:\\Windows\\SysWOW64\\wbem\\WmiPrvSE.exe"
+    ) and process.code_signature.trusted == true
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
new file mode 100644
index 0000000000..e4c11336ca
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity]]
+=== Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity
+
+A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where (problemchild.prediction == 1 or blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Masquerade Task or Service
+** ID: T1036.004
+** Reference URL: https://attack.mitre.org/techniques/T1036/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
new file mode 100644
index 0000000000..07a2459e30
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score]]
+=== Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
+
+A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* endgame-*
+* logs-endpoint.events.process-*
+* winlogbeat-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-10m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* OS: Windows
+* Data Source: Elastic Endgame
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where ((problemchild.prediction == 1 and problemchild.prediction_probability > 0.98) or
+blocklist_label == 1) and not process.args : ("*C:\\WINDOWS\\temp\\nessus_*.txt*", "*C:\\WINDOWS\\temp\\nessus_*.tmp*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Masquerade Task or Service
+** ID: T1036.004
+** Reference URL: https://attack.mitre.org/techniques/T1036/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process.asciidoc
new file mode 100644
index 0000000000..e428566793
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process]]
+=== Microsoft Build Engine Started an Unusual Process
+
+An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and process.parent.name:("MSBuild.exe" or "msbuild.exe") and
+process.name:("csc.exe" or "iexplore.exe" or "powershell.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Sub-technique:
+** Name: Compile After Delivery
+** ID: T1027.004
+** Reference URL: https://attack.mitre.org/techniques/T1027/004/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process.asciidoc
new file mode 100644
index 0000000000..10206df435
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process.asciidoc
@@ -0,0 +1,103 @@
+[[prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process]]
+=== Microsoft Build Engine Started by a Script Process
+
+An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 209
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and (
+  process.name.caseless:"msbuild.exe" or process.pe.original_file_name:"MSBuild.exe") and 
+  process.parent.name:("cmd.exe" or "powershell.exe" or "pwsh.exe" or "powershell_ise.exe" or "cscript.exe" or
+    "wscript.exe" or "mshta.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process.asciidoc
new file mode 100644
index 0000000000..5ac707e9df
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process]]
+=== Microsoft Build Engine Started by a System Process
+
+An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("explorer.exe", "wmiprvse.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application.asciidoc
new file mode 100644
index 0000000000..c48c56e181
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application.asciidoc
@@ -0,0 +1,163 @@
+[[prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application]]
+=== Microsoft Build Engine Started by an Office Application
+
+An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Build Engine Started by an Office Application*
+
+
+Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the execution of malicious documents.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "MSBuild.exe" and
+  process.parent.name : ("eqnedt32.exe",
+                         "excel.exe",
+                         "fltldr.exe",
+                         "msaccess.exe",
+                         "mspub.exe",
+                         "outlook.exe",
+                         "powerpnt.exe",
+                         "winword.exe" )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name.asciidoc
new file mode 100644
index 0000000000..09cc497e11
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -0,0 +1,158 @@
+[[prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name]]
+=== Microsoft Build Engine Using an Alternate Name
+
+An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Build Engine Using an Alternate Name*
+
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+The Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.
+
+This rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name == "MSBuild.exe" and
+  not process.name : "MSBuild.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
+* Technique:
+** Name: Trusted Developer Utilities Proxy Execution
+** ID: T1127
+** Reference URL: https://attack.mitre.org/techniques/T1127/
+* Sub-technique:
+** Name: MSBuild
+** ID: T1127.001
+** Reference URL: https://attack.mitre.org/techniques/T1127/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..f4766f2e5a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,103 @@
+[[prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes]]
+=== Microsoft Exchange Server UM Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
+* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("UMService.exe", "UMWorkerProcess.exe") and
+    not process.executable :
+              ("?:\\Windows\\System32\\werfault.exe",
+               "?:\\Windows\\System32\\wermgr.exe",
+               "?:\\Program Files\\Microsoft\\Exchange Server\\V??\\Bin\\UMWorkerProcess.exe",
+               "?:\\Program Files\\Microsoft\\Exchange Server\\Bin\\UMWorkerProcess.exe",
+               "D:\\Exchange 2016\\Bin\\UMWorkerProcess.exe",
+               "E:\\ExchangeServer\\Bin\\UMWorkerProcess.exe",
+               "D:\\Exchange\\Bin\\UMWorkerProcess.exe",
+               "D:\\Exchange Server\\Bin\\UMWorkerProcess.exe",
+               "E:\\Exchange Server\\V15\\Bin\\UMWorkerProcess.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files.asciidoc
new file mode 100644
index 0000000000..1a4998ed03
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files.asciidoc
@@ -0,0 +1,119 @@
+[[prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files]]
+=== Microsoft Exchange Server UM Writing Suspicious Files
+
+Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
+* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+Positive hits can be checked against the established Microsoft https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines[baselines].
+
+Microsoft highly recommends that the best course of action is patching, but this may not protect already compromised systems
+from existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support
+https://github.com/microsoft/CSS-Exchange/tree/main/Security[repository]
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  process.name : ("UMWorkerProcess.exe", "umservice.exe") and
+  file.extension : ("php", "jsp", "js", "aspx", "asmx", "asax", "cfm", "shtml") and
+  (
+    file.path : "?:\\inetpub\\wwwroot\\aspnet_client\\*" or
+
+    (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\owa\\auth\\*" and
+       not (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\owa\\auth\\version\\*" or
+            file.name : ("errorFE.aspx", "expiredpassword.aspx", "frowny.aspx", "GetIdToken.htm", "logoff.aspx",
+                        "logon.aspx", "OutlookCN.aspx", "RedirSuiteServiceProxy.aspx", "signout.aspx"))) or
+
+    (file.path : "?:\\*\\Microsoft\\Exchange Server*\\FrontEnd\\HttpProxy\\ecp\\auth\\*" and
+       not file.name : "TimeoutLogoff.aspx")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..e5e42c0566
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,102 @@
+[[prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes]]
+=== Microsoft Exchange Worker Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers
+* https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities
+* https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "w3wp.exe" and process.parent.args : "MSExchange*AppPool" and
+  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") or
+  ?process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption.asciidoc
new file mode 100644
index 0000000000..aa381a311d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption]]
+=== Microsoft IIS Connection Strings Decryption
+
+Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: 
+
+* https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
+* https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "aspnet_regiis.exe" or ?process.pe.original_file_name == "aspnet_regiis.exe") and
+  process.args : "connectionStrings" and process.args : "-pdf"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped.asciidoc
new file mode 100644
index 0000000000..eaed05c2c7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped]]
+=== Microsoft IIS Service Account Password Dumped
+
+Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: 
+
+* https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+   (process.name : "appcmd.exe" or ?process.pe.original_file_name == "appcmd.exe") and
+   process.args : "/list" and process.args : "/text*password"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-windows-defender-tampering.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-windows-defender-tampering.asciidoc
new file mode 100644
index 0000000000..ccedcbcfb5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-microsoft-windows-defender-tampering.asciidoc
@@ -0,0 +1,171 @@
+[[prebuilt-rule-8-12-8-microsoft-windows-defender-tampering]]
+=== Microsoft Windows Defender Tampering
+
+Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+* https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html
+* https://www.tenforums.com/tutorials/104025-turn-off-core-isolation-memory-integrity-windows-10-a.html
+* https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
+* https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html
+* https://www.tenforums.com/tutorials/51514-turn-off-microsoft-defender-periodic-scanning-windows-10-a.html
+* https://www.tenforums.com/tutorials/3569-turn-off-real-time-protection-microsoft-defender-antivirus.html
+* https://www.tenforums.com/tutorials/99576-how-schedule-scan-microsoft-defender-antivirus-windows-10-a.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Microsoft Windows Defender Tampering*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
+
+This rule monitors the registry for modifications that disable Windows Defender features.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine which features have been disabled, and check if this operation is done under change management and approved according to the organization's policy.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
+
+
+*Related rules*
+
+
+- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
+- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Take actions to restore the appropriate Windows Defender antivirus configurations.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\PUAProtection" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\App and Browser protection\\DisallowExploitProtectionOverride" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features\\TamperProtection" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIntrusionPreventionSystem" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScriptScanning" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Reporting\\DisableEnhancedNotifications" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\DisableBlockAtFirstSeen" and
+  registry.data.strings : ("1", "0x00000001")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SpynetReporting" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SpyNet\\SubmitSamplesConsent" and
+  registry.data.strings : ("0", "0x00000000")) or
+  (registry.path : "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" and
+  registry.data.strings : ("1", "0x00000001"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected.asciidoc
new file mode 100644
index 0000000000..747d232f0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected]]
+=== Mimikatz Memssp Log File Detected
+
+Identifies the password log file from the default Mimikatz memssp module.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Mimikatz Memssp Log File Detected*
+
+
+https://github.com/gentilkiwi/mimikatz[Mimikatz] is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.
+
+This rule looks for the creation of a file named `mimilsa.log`, which is generated when using the Mimikatz misc::memssp module, which injects a malicious Windows SSP to collect locally authenticated credentials, which includes the computer account password, running service credentials, and any accounts that logon.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
+- Retrieve and inspect the log file contents.
+- Search for DLL files created in the same location as the log file, and retrieve unsigned DLLs.
+  - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of these files.
+    - Search for the existence of these files in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+  - Identify the process that created the DLL using file creation events.
+
+
+*False positive analysis*
+
+
+- This file name `mimilsa.log` should not legitimately be created.
+
+
+*Related rules*
+
+
+- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the host is a Domain Controller (DC):
+  - Activate your incident response plan for total Active Directory compromise.
+  - Review the privileges assigned to users that can access the DCs to ensure that the least privilege principle is being followed and reduce the attack surface.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reboot the host to remove the injected SSP from memory.
+- Reimage the host operating system or restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and file.name : "mimilsa.log" and process.name : "lsass.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-amsienable-registry-key.asciidoc
new file mode 100644
index 0000000000..decc6efcba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-amsienable-registry-key.asciidoc
@@ -0,0 +1,162 @@
+[[prebuilt-rule-8-12-8-modification-of-amsienable-registry-key]]
+=== Modification of AmsiEnable Registry Key
+
+Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf
+* https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Modification of AmsiEnable Registry Key*
+
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+Since AMSI is widely used across security products for increased visibility, attackers can disable it to evade detections that rely on it.
+
+This rule monitors the modifications to the Software\Microsoft\Windows Script\Settings\AmsiEnable registry key.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the execution of scripts and macros after the registry modification.
+- Retrieve scripts or Microsoft Office files and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences on other hosts.
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
+
+
+*Related rules*
+
+
+- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Delete or set the key to its default value.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path : (
+    "HKEY_USERS\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
+    "HKU\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable",
+    "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable"
+  ) and
+  registry.data.strings: ("0", "0x00000000")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-boot-configuration.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-boot-configuration.asciidoc
new file mode 100644
index 0000000000..dee41561bc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-boot-configuration.asciidoc
@@ -0,0 +1,139 @@
+[[prebuilt-rule-8-12-8-modification-of-boot-configuration]]
+=== Modification of Boot Configuration
+
+Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Modification of Boot Configuration*
+
+
+Boot entry parameters, or boot parameters, are optional, system-specific settings that represent configuration options. These are stored in a boot configuration data (BCD) store, and administrators can use utilities like `bcdedit.exe` to configure these.
+
+This rule identifies the usage of `bcdedit.exe` to:
+
+- Disable Windows Error Recovery (recoveryenabled).
+- Ignore errors if there is a failed boot, failed shutdown, or failed checkpoint (bootstatuspolicy ignoreallfailures).
+
+These are common steps in destructive attacks by adversaries leveraging ransomware.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Check if any files on the host machine have been encrypted.
+
+
+*False positive analysis*
+
+
+- The usage of these options is not inherently malicious. Administrators can modify these configurations to force a machine to boot for troubleshooting or data recovery purposes.
+
+
+*Related rules*
+
+
+- Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "bcdedit.exe" or ?process.pe.original_file_name == "bcdedit.exe") and
+    (
+      (process.args : "/set" and process.args : "bootstatuspolicy" and process.args : "ignoreallfailures") or
+      (process.args : "no" and process.args : "recoveryenabled")
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-wdigest-security-provider.asciidoc
new file mode 100644
index 0000000000..d68d9f508b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-modification-of-wdigest-security-provider.asciidoc
@@ -0,0 +1,152 @@
+[[prebuilt-rule-8-12-8-modification-of-wdigest-security-provider]]
+=== Modification of WDigest Security Provider
+
+Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
+* https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019
+* https://frsecure.com/compromised-credentials-response-playbook
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Modification of WDigest Security Provider*
+
+
+In Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default, which is no longer the case with newer Windows versions.
+
+Still, attackers can force WDigest to store the passwords insecurely on the memory by modifying the `HKLM\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\UseLogonCredential` registry key. This activity is commonly related to the execution of credential dumping tools.
+
+
+*Possible investigation steps*
+
+
+- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should treat any activity triggered from this rule with high priority as it typically represents an active adversary.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Determine if credential dumping tools were run on the host, and retrieve and analyze suspicious executables:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences on other hosts.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team, as these modifications expose the entire domain to credential compromises and consequently unauthorized access.
+
+
+*Related rules*
+
+
+- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type : ("creation", "change") and
+    registry.path : (
+        "HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential",
+        "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
+    ) and registry.data.strings : ("1", "0x00000001") and
+    not (process.executable : "?:\\Windows\\System32\\svchost.exe" and user.id : "S-1-5-18")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares.asciidoc
new file mode 100644
index 0000000000..d3f957934f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares.asciidoc
@@ -0,0 +1,118 @@
+[[prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares]]
+=== Mounting Hidden or WebDav Remote Shares
+
+Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ ((process.name : "net.exe" or ?process.pe.original_file_name == "net.exe") or ((process.name : "net1.exe" or ?process.pe.original_file_name == "net1.exe") and
+ not process.parent.name : "net.exe")) and
+ process.args : "use" and
+ /* including hidden and webdav based online shares such as onedrive  */
+ process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and
+ /* excluding shares deletion operation */
+ not process.args : "/d*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Valid Accounts
+** ID: T1078
+** Reference URL: https://attack.mitre.org/techniques/T1078/
+* Sub-technique:
+** Name: Local Accounts
+** ID: T1078.003
+** Reference URL: https://attack.mitre.org/techniques/T1078/003/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Sub-technique:
+** Name: Domain Account
+** ID: T1087.002
+** Reference URL: https://attack.mitre.org/techniques/T1087/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-network-logon-provider-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-network-logon-provider-registry-modification.asciidoc
new file mode 100644
index 0000000000..c95d0d1f18
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-network-logon-provider-registry-modification.asciidoc
@@ -0,0 +1,161 @@
+[[prebuilt-rule-8-12-8-network-logon-provider-registry-modification]]
+=== Network Logon Provider Registry Modification
+
+Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
+* https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Network Logon Provider Registry Modification*
+
+
+Network logon providers are components in Windows responsible for handling the authentication process during a network logon.
+
+This rule identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in plain text during user logon.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the `registry.data.strings` field to identify the DLL registered.
+- Identify the process responsible for the registry operation and the file creation and investigate their process execution chains (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+  - Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+  - Investigate any abnormal behavior by the subject process, such as network connections, DLLs loaded, registry or file modifications, and any spawned child processes.
+- Retrieve the file and examine if it is signed with valid digital signatures from vendors that are supposed to implement this kind of software and approved to use in the environment. Check for prevalence in the environment and whether they are located in expected locations.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the executables of the processes using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+
+*False positive analysis*
+
+
+- False Positives can include legitimate software installations or updates that modify the network logon provider registry. These modifications may be necessary for the proper functioning of the software and are not indicative of malicious activity.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.data.strings : "?*" and
+  registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath"
+  ) and
+  /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */
+  not (
+    user.id : "S-1-5-18" and
+    registry.data.strings : (
+        "%SystemRoot%\\System32\\ntlanman.dll",
+        "%SystemRoot%\\System32\\drprov.dll",
+        "%SystemRoot%\\System32\\davclnt.dll",
+        "%SystemRoot%\\System32\\vmhgfs.dll",
+        "?:\\Program Files (x86)\\Citrix\\ICA Client\\x64\\pnsson.dll",
+        "?:\\Program Files\\Dell\\SARemediation\\agent\\DellMgmtNP.dll",
+        "?:\\Program Files (x86)\\CheckPoint\\Endpoint Connect\\\\epcgina.dll"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell.asciidoc
new file mode 100644
index 0000000000..d26f58f9e5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell.asciidoc
@@ -0,0 +1,99 @@
+[[prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell]]
+=== New ActiveSyncAllowedDeviceID Added via PowerShell
+
+Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+* https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name: ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and process.args : "Set-CASMailbox*ActiveSyncAllowedDeviceIDs*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Account Manipulation
+** ID: T1098
+** Reference URL: https://attack.mitre.org/techniques/T1098/
+* Sub-technique:
+** Name: Additional Email Delegate Permissions
+** ID: T1098.002
+** Reference URL: https://attack.mitre.org/techniques/T1098/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied.asciidoc
new file mode 100644
index 0000000000..7b52f0b9ba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied.asciidoc
@@ -0,0 +1,168 @@
+[[prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied]]
+=== NTDS or SAM Database File Copied
+
+Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 33
+
+*References*: 
+
+* https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating NTDS or SAM Database File Copied*
+
+
+The Active Directory Domain Database (ntds.dit) and Security Account Manager (SAM) files are critical components in Windows environments, containing sensitive information such as hashed domain and local credentials.
+
+This rule identifies copy operations of these files using specific command-line tools, such as Cmd.Exe, PowerShell.EXE, XCOPY.EXE, and esentutl.exe. By monitoring for the presence of these tools and their associated arguments, the rule aims to detect potential credential access activities.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, command lines, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check for any recent changes in user account privileges or group memberships that may have allowed the unauthorized access.
+- Determine whether the file was potentially exfiltrated from the subject host.
+- Scope compromised credentials and disable the accounts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Look for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restore the affected system to its operational state by applying any necessary patches, updates, or configuration changes.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    ((?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE") or process.name : ("Cmd.Exe", "PowerShell.EXE", "XCOPY.EXE")) and
+       process.args : ("copy", "xcopy", "Copy-Item", "move", "cp", "mv")
+    ) or
+    ((?process.pe.original_file_name : "esentutl.exe" or process.name : "esentutl.exe") and process.args : ("*/y*", "*/vss*", "*/d*"))
+  ) and
+  process.command_line : ("*\\ntds.dit*", "*\\config\\SAM*", "*\\*\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\*", "*/system32/config/SAM*", "*\\User Data\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-nullsessionpipe-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-nullsessionpipe-registry-modification.asciidoc
new file mode 100644
index 0000000000..9e8fb82616
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-nullsessionpipe-registry-modification.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-nullsessionpipe-registry-modification]]
+=== NullSessionPipe Registry Modification
+
+Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
+* https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\services\\LanmanServer\\Parameters\\NullSessionPipes"
+) and length(registry.data.strings) > 0
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell.asciidoc
new file mode 100644
index 0000000000..39bd1b5c95
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell.asciidoc
@@ -0,0 +1,79 @@
+[[prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell]]
+=== Outbound Scheduled Task Activity via PowerShell
+
+Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, process.entity_id with maxspan = 5s
+ [any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
+  (?dll.name : "taskschd.dll" or file.name : "taskschd.dll") and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
+ [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-parent-process-pid-spoofing.asciidoc
new file mode 100644
index 0000000000..b1afe37c0f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-parent-process-pid-spoofing.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-12-8-parent-process-pid-spoofing]]
+=== Parent Process PID Spoofing
+
+Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.didierstevens.com/2017/03/20/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is compatible with Elastic Endpoint only */
+
+sequence by host.id, user.id with maxspan=3m 
+
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.Ext.token.integrity_level_name != "system" and 
+  (
+    process.pe.original_file_name : ("winword.exe", "excel.exe", "outlook.exe", "powerpnt.exe", "eqnedt32.exe",
+                                     "fltldr.exe", "mspub.exe", "msaccess.exe", "powershell.exe", "pwsh.exe",
+                                     "cscript.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe", "msbuild.exe",
+                                     "mshta.exe", "wmic.exe", "cmstp.exe", "msxsl.exe") or 
+                                     
+    (process.executable : ("?:\\Users\\*.exe",
+                           "?:\\ProgramData\\*.exe",
+                           "?:\\Windows\\Temp\\*.exe",
+                           "?:\\Windows\\Tasks\\*") and 
+      (process.code_signature.exists == false or process.code_signature.status : "errorBadDigest")) or 
+                          
+    process.executable : "?:\\Windows\\Microsoft.NET\\*.exe"                      
+  ) and 
+  
+  not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
+  ] by process.pid
+ [process where host.os.type == "windows" and event.type == "start" and
+  process.parent.Ext.real.pid > 0 and 
+ 
+  /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */
+  not (process.name : "msedge.exe" and process.parent.name : "sihost.exe") and 
+  
+   not process.executable : 
+             ("?:\\Windows\\System32\\WerFaultSecure.exe", 
+              "?:\\WINDOWS\\SysWOW64\\WerFaultSecure.exe",
+              "?:\\Windows\\System32\\WerFault.exe",
+              "?:\\Windows\\SysWOW64\\WerFault.exe")
+ ] by process.parent.Ext.real.pid
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Parent PID Spoofing
+** ID: T1134.004
+** Reference URL: https://attack.mitre.org/techniques/T1134/004/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Parent PID Spoofing
+** ID: T1134.004
+** Reference URL: https://attack.mitre.org/techniques/T1134/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-peripheral-device-discovery.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-peripheral-device-discovery.asciidoc
new file mode 100644
index 0000000000..ea13d7f903
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-peripheral-device-discovery.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-12-8-peripheral-device-discovery]]
+=== Peripheral Device Discovery
+
+Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Peripheral Device Discovery*
+
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the execution of the `fsutil` utility with the `fsinfo` subcommand to enumerate drives attached to the computer, which can be used to identify secondary drives used for backups, mapped network drives, and removable media. These devices can contain valuable information for attackers.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+- Determine whether this activity was followed by suspicious file access/copy operations or uploads to file storage services.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "fsutil.exe" or ?process.pe.original_file_name == "fsutil.exe") and
+  process.args : "fsinfo" and process.args : "drives"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Peripheral Device Discovery
+** ID: T1120
+** Reference URL: https://attack.mitre.org/techniques/T1120/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline.asciidoc
new file mode 100644
index 0000000000..69d4ce4810
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline.asciidoc
@@ -0,0 +1,89 @@
+[[prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline]]
+=== Persistence via BITS Job Notify Cmdline
+
+An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://pentestlab.blog/2019/10/30/persistence-bits-jobs/
+* https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline
+* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-setnotifycmdline
+* https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "svchost.exe" and process.parent.args : "BITS" and
+  not process.executable :
+              ("?:\\Windows\\System32\\WerFaultSecure.exe",
+               "?:\\Windows\\System32\\WerFault.exe",
+               "?:\\Windows\\System32\\wermgr.exe",
+               "?:\\WINDOWS\\system32\\directxdatabaseupdater.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: BITS Jobs
+** ID: T1197
+** Reference URL: https://attack.mitre.org/techniques/T1197/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected.asciidoc
new file mode 100644
index 0000000000..0eff145dbc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected.asciidoc
@@ -0,0 +1,116 @@
+[[prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected]]
+=== Persistence via Hidden Run Key Detected
+
+Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/outflanknl/SharpHide
+* https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* Registry Path ends with backslash */
+registry where host.os.type == "windows" and /* length(registry.data.strings) > 0 and */
+ registry.path : ("HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins.asciidoc
new file mode 100644
index 0000000000..30b93beaad
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins.asciidoc
@@ -0,0 +1,91 @@
+[[prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins]]
+=== Persistence via Microsoft Office AddIns
+
+Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+ file.extension : ("wll","xll","ppa","ppam","xla","xlam") and
+ file.path :
+    (
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Word\\Startup\\*",
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\AddIns\\*",
+    "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Office Application Startup
+** ID: T1137
+** Reference URL: https://attack.mitre.org/techniques/T1137/
+* Sub-technique:
+** Name: Add-ins
+** ID: T1137.006
+** Reference URL: https://attack.mitre.org/techniques/T1137/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba.asciidoc
new file mode 100644
index 0000000000..450c3c3535
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba]]
+=== Persistence via Microsoft Outlook VBA
+
+Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
+* https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+ file.path : "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Outlook\\VbaProject.OTM"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Office Application Startup
+** ID: T1137
+** Reference URL: https://attack.mitre.org/techniques/T1137/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-powershell-profile.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-powershell-profile.asciidoc
new file mode 100644
index 0000000000..23c68e99b1
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-powershell-profile.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-12-8-persistence-via-powershell-profile]]
+=== Persistence via PowerShell profile
+
+Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles
+* https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Persistence via PowerShell profile*
+
+
+PowerShell profiles are scripts executed when PowerShell starts, customizing the user environment. They are commonly used in Windows environments for legitimate purposes, such as setting variables or loading modules. However, adversaries can abuse PowerShell profiles to establish persistence by inserting malicious code that executes each time PowerShell is launched.
+
+This rule identifies the creation or modification of a PowerShell profile. It does this by monitoring file events on Windows systems, specifically targeting profile-related file paths and names, such as `profile.ps1` and `Microsoft.Powershell_profile.ps1`. By detecting these activities, security analysts can investigate potential abuse of PowerShell profiles for malicious persistence.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Retrive and inspect the PowerShell profile content; look for suspicious DLL imports, collection or persistence capabilities, suspicious functions, encoded or compressed data, suspicious commands, and other potentially malicious characteristics.
+- Identify the process responsible for the PowerShell profile creation/modification. Use the Elastic Defend events to examine all the activity of the subject process by filtering by the process's `process.entity_id`.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Check for additional PowerShell and command-line logs that indicate that any suspicious command or function were run.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This is a dual-use mechanism, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the script doesn't contain malicious functions or potential for abuse, no other suspicious activity was identified, and the user has business justifications to use PowerShell.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+  - Consider enabling and collecting PowerShell logs such as transcription, module, and script block logging, to improve visibility into PowerShell activities.
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.path : ("?:\\Users\\*\\Documents\\WindowsPowerShell\\*",
+               "?:\\Users\\*\\Documents\\PowerShell\\*",
+               "?:\\Windows\\System32\\WindowsPowerShell\\*") and
+  file.name : ("profile.ps1", "Microsoft.Powershell_profile.ps1")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: PowerShell Profile
+** ID: T1546.013
+** Reference URL: https://attack.mitre.org/techniques/T1546/013/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: PowerShell Profile
+** ID: T1546.013
+** Reference URL: https://attack.mitre.org/techniques/T1546/013/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation.asciidoc
new file mode 100644
index 0000000000..c916d17cc7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation]]
+=== Persistence via Scheduled Job Creation
+
+A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.path : "?:\\Windows\\Tasks\\*" and file.extension : "job" and
+  not (
+    (
+      process.executable : "?:\\Program Files\\CCleaner\\CCleaner64.exe" and
+      file.path : "?:\\Windows\\Tasks\\CCleanerCrashReporting.job"
+    ) or
+    (
+      process.executable : (
+        "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\dcagentregister.exe",
+        "?:\\Program Files (x86)\\DesktopCentral_Agent\\bin\\dcagentregister.exe"
+      ) and
+      file.path : "?:\\Windows\\Tasks\\DCAgentUpdater.job"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
new file mode 100644
index 0000000000..1f1c9a9676
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack]]
+=== Persistence via TelemetryController Scheduled Task Hijack
+
+Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "CompatTelRunner.exe" and process.args : "-cv*" and
+  not process.name : ("conhost.exe",
+                      "DeviceCensus.exe",
+                      "CompatTelRunner.exe",
+                      "DismHost.exe",
+                      "rundll32.exe",
+                      "powershell.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack.asciidoc
new file mode 100644
index 0000000000..3c2dfd6a5c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -0,0 +1,180 @@
+[[prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack]]
+=== Persistence via Update Orchestrator Service Hijack
+
+Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/irsl/CVE-2020-1313
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Persistence via Update Orchestrator Service Hijack*
+
+
+Windows Update Orchestrator Service is a DCOM service used by other components to install Windows updates that are already downloaded. Windows Update Orchestrator Service was vulnerable to elevation of privileges (any user to local system) due to an improper authorization of the callers. The vulnerability affected the Windows 10 and Windows Server Core products. Fixed by Microsoft on Patch Tuesday June 2020.
+
+This rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.executable : "C:\\Windows\\System32\\svchost.exe" and
+  process.parent.args : "UsoSvc" and
+  not process.executable :
+          ("?:\\ProgramData\\Microsoft\\Windows\\UUS\\Packages\\*\\amd64\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\System32\\UsoClient.exe",
+          "?:\\Windows\\System32\\MusNotification.exe",
+          "?:\\Windows\\System32\\MusNotificationUx.exe",
+          "?:\\Windows\\System32\\MusNotifyIcon.exe",
+          "?:\\Windows\\System32\\WerFault.exe",
+          "?:\\Windows\\System32\\WerMgr.exe",
+          "?:\\Windows\\UUS\\amd64\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\System32\\MoUsoCoreWorker.exe",
+          "?:\\Windows\\UUS\\amd64\\UsoCoreWorker.exe",
+          "?:\\Windows\\System32\\UsoCoreWorker.exe",
+          "?:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") and
+  not process.name : ("MoUsoCoreWorker.exe", "OfficeC2RClient.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription.asciidoc
new file mode 100644
index 0000000000..70739b36a0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription]]
+=== Persistence via WMI Event Subscription
+
+An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "wmic.exe" or ?process.pe.original_file_name == "wmic.exe") and
+  process.args : "create" and
+  process.args : ("ActiveScriptEventConsumer", "CommandLineEventConsumer")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Windows Management Instrumentation Event Subscription
+** ID: T1546.003
+** Reference URL: https://attack.mitre.org/techniques/T1546/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider.asciidoc
new file mode 100644
index 0000000000..eae1d11d15
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider.asciidoc
@@ -0,0 +1,201 @@
+[[prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider]]
+=== Persistence via WMI Standard Registry Provider
+
+Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Persistence via WMI Standard Registry Provider*
+
+
+The Windows Management Instrumentation (WMI) StdRegProv is a registry provider that allows users to manage registry keys and values on Windows systems. Adversaries may abuse this functionality to modify registry locations commonly used for persistence, enabling them to maintain unauthorized access to a system.
+
+This rule identifies instances where the WMI StdRegProv is used to modify specific registry paths associated with persistence mechanisms.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Identify which process triggered this behavior.
+- Verify whether the file specified in the run key is signed.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Examine the file specified in the run key using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+ registry.data.strings != null and process.name : "WmiPrvSe.exe" and
+ registry.path : (
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
+                  "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
+                  "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+                  "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+                  "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+                  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\ServiceDLL",
+                  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\ImagePath",
+                  "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+                  "\\REGISTRY\\USER\\*\\Environment\\UserInitMprLogonScript",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+                  "\\REGISTRY\\USER\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script"
+                  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory.asciidoc
new file mode 100644
index 0000000000..4fbd28ac41
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory.asciidoc
@@ -0,0 +1,173 @@
+[[prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory]]
+=== Persistent Scripts in the Startup Directory
+
+Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Persistent Scripts in the Startup Directory*
+
+
+The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
+
+This rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related rules*
+
+
+- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
+- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+
+  file.extension : ("lnk", "vbs", "vbe", "wsh", "wsf", "js") and
+  not (startsWith(user.domain, "NT") or endsWith(user.domain, "NT")) and
+
+  /* detect shortcuts created by wscript.exe or cscript.exe */
+  (file.path : "C:\\*\\Programs\\Startup\\*.lnk" and
+     process.name : ("wscript.exe", "cscript.exe")) or
+
+  /* detect vbs or js files created by any process */
+  file.path : ("C:\\*\\Programs\\Startup\\*.vbs",
+               "C:\\*\\Programs\\Startup\\*.vbe",
+               "C:\\*\\Programs\\Startup\\*.wsh",
+               "C:\\*\\Programs\\Startup\\*.wsf",
+               "C:\\*\\Programs\\Startup\\*.js")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Sub-technique:
+** Name: Shortcut Modification
+** ID: T1547.009
+** Reference URL: https://attack.mitre.org/techniques/T1547/009/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-port-forwarding-rule-addition.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-port-forwarding-rule-addition.asciidoc
new file mode 100644
index 0000000000..8f6d74abea
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-port-forwarding-rule-addition.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-12-8-port-forwarding-rule-addition]]
+=== Port Forwarding Rule Addition
+
+Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Port Forwarding Rule Addition*
+
+
+Network port forwarding is a mechanism to redirect incoming TCP connections (IPv4 or IPv6) from the local TCP port to any other port number, or even to a port on a remote computer.
+
+Attackers may configure port forwarding rules to bypass network segmentation restrictions, using the host as a jump box to access previously unreachable systems.
+
+This rule monitors the modifications to the `HKLM\SYSTEM\*ControlSet*\Services\PortProxy\v4tov4\` subkeys.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Identify the target host IP address, check the connections originating from the host where the modification occurred, and inspect the credentials used.
+  - Investigate suspicious login activity, such as unauthorized access and logins from outside working hours and unusual locations.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Delete the port forwarding rule.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+  "HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*",
+  "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*"
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
new file mode 100644
index 0000000000..fa22bc3fff
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
@@ -0,0 +1,94 @@
+[[prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation]]
+=== Potential ADIDNS Poisoning via Wildcard Record Creation
+
+Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS spoofing.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/
+* https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/adidns-spoofing
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Use Case: Active Directory Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and event.action == "Directory Service Changes" and
+    event.code == "5137" and startsWith(winlog.event_data.ObjectDN, "DC=*,")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst.asciidoc
new file mode 100644
index 0000000000..0e9dde19d7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst.asciidoc
@@ -0,0 +1,97 @@
+[[prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst]]
+=== Potential Application Shimming via Sdbinst
+
+The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "sdbinst.exe" and
+  process.args : "?*" and
+  not (process.args : "-m" and process.args : "-bg") and
+  not process.args : "-mm"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Application Shimming
+** ID: T1546.011
+** Reference URL: https://attack.mitre.org/techniques/T1546/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities.asciidoc
new file mode 100644
index 0000000000..c87fecfdfa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities.asciidoc
@@ -0,0 +1,181 @@
+[[prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities]]
+=== Potential Credential Access via Windows Utilities
+
+Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Credential Access via Windows Utilities*
+
+
+Local Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.
+
+The `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.
+
+This rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to identify what information was targeted.
+- Identify the target computer and its role in the IT environment.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If the host is a domain controller (DC):
+  - Activate your incident response plan for total Active Directory compromise.
+  - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (
+    (?process.pe.original_file_name : "procdump" or process.name : "procdump.exe") and process.args : "-ma"
+  ) or
+  (
+    process.name : "ProcessDump.exe" and not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Cisco Systems\\.*"""
+  ) or
+  (
+    (?process.pe.original_file_name : "WriteMiniDump.exe" or process.name : "WriteMiniDump.exe") and
+      not process.parent.executable regex~ """C:\\Program Files( \(x86\))?\\Steam\\.*"""
+  ) or
+  (
+    (?process.pe.original_file_name : "RUNDLL32.EXE" or process.name : "RUNDLL32.exe") and
+      (process.args : "MiniDump*" or process.command_line : "*comsvcs.dll*#24*")
+  ) or
+  (
+    (?process.pe.original_file_name : "RdrLeakDiag.exe" or process.name : "RdrLeakDiag.exe") and
+      process.args : "/fullmemdmp"
+  ) or
+  (
+    (?process.pe.original_file_name : "SqlDumper.exe" or process.name : "SqlDumper.exe") and
+      process.args : "0x01100*") or
+  (
+    (?process.pe.original_file_name : "TTTracer.exe" or process.name : "TTTracer.exe") and
+      process.args : "-dumpFull" and process.args : "-attach") or
+  (
+    (?process.pe.original_file_name : "ntdsutil.exe" or process.name : "ntdsutil.exe") and
+      process.args : "create*full*") or
+  (
+    (?process.pe.original_file_name : "diskshadow.exe" or process.name : "diskshadow.exe") and process.args : "/s")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
new file mode 100644
index 0000000000..0d1a027c9b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable]]
+=== Potential DLL Side-Loading via Microsoft Antimalware Service Executable
+
+Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+* Dennis Perto
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+(
+  (process.pe.original_file_name == "MsMpEng.exe" and not process.name : "MsMpEng.exe") or
+  (process.name : "MsMpEng.exe" and not
+        process.executable : ("?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Windows Defender\\*.exe",
+                              "?:\\Program Files (x86)\\Windows Defender\\*.exe",
+                              "?:\\Program Files\\Microsoft Security Client\\*.exe",
+                              "?:\\Program Files (x86)\\Microsoft Security Client\\*.exe"))
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
new file mode 100644
index 0000000000..edca1982b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs]]
+=== Potential DLL Side-Loading via Trusted Microsoft Programs
+
+Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name in ("WinWord.exe", "EXPLORER.EXE", "w3wp.exe", "DISM.EXE") and
+  not (process.name : ("winword.exe", "explorer.exe", "w3wp.exe", "Dism.exe") or
+         process.executable : ("?:\\Windows\\explorer.exe",
+                               "?:\\Program Files\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Program Files?(x86)\\Microsoft Office\\root\\Office*\\WINWORD.EXE",
+                               "?:\\Windows\\System32\\Dism.exe",
+                               "?:\\Windows\\SysWOW64\\Dism.exe",
+                               "?:\\Windows\\System32\\inetsrv\\w3wp.exe")
+         )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup.asciidoc
new file mode 100644
index 0000000000..d72fd64b20
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup.asciidoc
@@ -0,0 +1,125 @@
+[[prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup]]
+=== Potential DNS Tunneling via NsLookup
+
+This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential DNS Tunneling via NsLookup*
+
+
+Attackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as their command and control and/or exfiltration channel.
+
+DNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration, since queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.
+
+More information on how tunneling works and how it can be abused can be found on https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors[Palo Alto Unit42 Research].
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the DNS query and identify the information sent.
+- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor command and control related, this alert can be closed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Immediately block the identified indicators of compromise (IoCs).
+- Implement any temporary network rules, procedures, and segmentation required to contain the attack.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Update firewall rules to be more restrictive.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=5m
+[process where host.os.type == "windows" and event.type == "start" and
+  process.name : "nslookup.exe" and process.args:("-querytype=*", "-qt=*", "-q=*", "-type=*")] with runs = 10
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: DNS
+** ID: T1071.004
+** Reference URL: https://attack.mitre.org/techniques/T1071/004/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-filter-manager.asciidoc
new file mode 100644
index 0000000000..552c014875
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-filter-manager.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-12-8-potential-evasion-via-filter-manager]]
+=== Potential Evasion via Filter Manager
+
+The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Evasion via Filter Manager*
+
+
+A file system filter driver, or minifilter, is a specialized type of filter driver designed to intercept and modify I/O requests sent to a file system or another filter driver. Minifilters are used by a wide range of security software, including EDR, antivirus, backup agents, encryption products, etc.
+
+Attackers may try to unload minifilters to avoid protections such as malware detection, file system monitoring, and behavior-based detections.
+
+This rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine the command line event to identify the target driver.
+  - Identify the minifilter's role in the environment and if it is security-related. Microsoft provides a https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes[list] of allocated altitudes that may provide more context, such as the manufacturer.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for the action.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "fltMC.exe" and process.args : "unload" and
+  not
+  (
+    (
+      process.executable : "?:\\Program Files (x86)\\ManageEngine\\UEMS_Agent\\bin\\DCFAService64.exe" and
+      process.args : ("DFMFilter", "DRMFilter")
+    ) or
+    (
+      process.executable : "?:\\Windows\\SysWOW64\\msiexec.exe" and
+      process.args : ("BrFilter_*", "BrCow_*") and
+      user.id : "S-1-5-18"
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform.asciidoc
new file mode 100644
index 0000000000..1c4953b7d5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform]]
+=== Potential Evasion via Windows Filtering Platform
+
+Identifies multiple Windows Filtering Platform block events and where the process name is related to an endpoint security software. Adversaries may add malicious WFP rules to prevent Endpoint security from sending telemetry.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.network-*
+* logs-system.security-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/dsnezhkov/shutter/tree/main
+* https://github.com/netero1010/EDRSilencer/tree/main
+* https://www.mdsec.co.uk/2023/09/nighthawk-0-2-6-three-wise-monkeys/
+* https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5157
+* https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Filtering Platform Connection' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+Object Access >
+Filtering Platform Connection (Success,Failure)
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by winlog.computer_name with maxspan=1m
+ [network where host.os.type == "windows" and 
+  event.action : ("windows-firewall-packet-block", "windows-firewall-packet-drop") and 
+  process.name : (
+        "bdagent.exe", "bdreinit.exe", "pdscan.exe", "pdiface.exe", "BDSubWiz.exe", "ProductAgentService.exe",
+        "ProductAgentUI.exe", "WatchDog.exe", "CarbonBlackClientSetup.exe", "TrGUI.exe", "TracCAPI.exe", "cpmsi_tool.exe",
+        "trac.exe", "vna_install64.exe", "vna_utils.exe", "TracSrvWrapper.exe", "vsmon.exe", "p95tray.exe",
+        "CybereasonRansomFreeServiceHost.exe", "CrAmTray.exe", "minionhost.exe", "CybereasonSensor.exe", "CylanceUI.exe",
+        "CylanceProtectSetup.exe", "cylancesvc.exe", "cyupdate.exe", "elastic-agent.exe", "elastic-endpoint.exe",
+        "egui.exe", "minodlogin.exe", "emu-rep.exe", "emu_install.exe", "emu-cci.exe", "emu-gui.exe", "emu-uninstall.exe",
+        "ndep.exe", "spike.exe", "ecls.exe", "ecmd.exe", "ecomserver.exe", "eeclnt.exe", "eh64.exe", "EHttpSrv.exe",
+        "xagt.exe", "collectoragent.exe", "FSAEConfig.exe", "uninstalldcagent.exe", "rmon.exe", "fccomint.exe",
+        "fclanguageselector.exe", "fortifw.exe", "fcreg.exe", "fortitray.exe", "fcappdb.exe", "fcwizard.exe", "submitv.exe",
+        "av_task.exe", "fortiwf.exe", "fortiwadbd.exe", "fcauth.exe", "fcdblog.exe", "fcmgr.exe", "fortiwad.exe",
+        "fortiproxy.exe", "fortiscand.exe", "fortivpnst.exe", "ipsec.exe", "fcwscd7.exe", "fcasc.exe", "fchelper.exe",
+        "forticlient.exe","fcwsc.exe", "FortiClient.exe", "fmon.exe", "FSSOMA.exe", "FCVbltScan.exe", "FortiESNAC.exe",
+        "EPCUserAvatar.exe", "FortiAvatar.exe", "FortiClient_Diagnostic_Tool.exe", "FortiSSLVPNdaemon.exe", "avp.exe",
+        "FCConfig.exe", "avpsus.exe", "klnagent.exe", "klnsacwsrv.exe", "kl_platf.exe", "stpass.exe", "klnagwds.exe",
+        "mbae.exe", "mbae64.exe", "mbae-svc.exe", "mbae-uninstaller.exe", "mbaeLoader32.exe", "mbaeloader64.exe",
+        "mbam-dor.exe", "mbamgui.exe", "mbamservice.exe", "mbamtrayctrl.exe", "mbampt.exe", "mbamscheduler.exe",
+        "Coreinst.exe", "mbae-setup.exe", "mcupdate.exe", "ProtectedModuleHost.exe", "ESConfigTool.exe", "FWInstCheck.exe",
+        "FwWindowsFirewallHandler.exe", "mfeesp.exe", "mfefw.exe", "mfeProvisionModeUtility.exe", "mfetp.exe", "avpui.exe", 
+        "WscAVExe.exe", "mcshield.exe", "McChHost.exe", "mfewc.exe", "mfewch.exe", "mfewcui.exe", "fwinfo.exe",
+        "mfecanary.exe", "mfefire.exe", "mfehidin.exe", "mfemms.exe", "mfevtps.exe", "mmsinfo.exe", "vtpinfo.exe",
+        "MarSetup.exe", "mctray.exe", "masvc.exe", "macmnsvc.exe", "McAPExe.exe", "McPvTray.exe", "mcods.exe",
+        "mcuicnt.exe", "mcuihost.exe", "xtray.exe", "McpService.exe", "epefprtrainer.exe", "mfeffcoreservice.exe",
+        "MfeEpeSvc.exe", "qualysagent.exe", "QualysProxy.exe", "QualysAgentUI.exe", "SVRTgui.exe", "SVRTcli.exe",
+        "SVRTcli.exe", "SVRTgui.exe", "SCTCleanupService.exe", "SVRTservice.exe", "native.exe", "SCTBootTasks.exe",
+        "ALMon.exe", "SAA.exe", "SUMService.exe", "ssp.exe", "SCFService.exe", "SCFManager.exe", "spa.exe", "cabarc.exe",
+        "sargui.exe", "sntpservice.exe", "McsClient.exe", "McsAgent.exe", "McsHeartbeat.exe", "SAVAdminService.exe",
+        "sav32cli.exe", "ForceUpdateAlongSideSGN.exe", "SAVCleanupService.exe", "SavMain.exe", "SavProgress.exe", 
+        "SavProxy.exe", "SavService.exe", "swc_service.exe", "swi_di.exe", "swi_service.exe", "swi_filter.exe",
+        "ALUpdate.exe", "SophosUpdate.exe", "ALsvc.exe", "SophosAlert.exe", "osCheck.exe", "N360Downloader.exe",
+        "InstWrap.exe", "symbos.exe", "nss.exe", "symcorpui.exe", "isPwdSvc.exe", "ccsvchst.exe", "ntrmv.exe",
+        "pccntmon.exe", "AosUImanager.exe", "NTRTScan.exe", "TMAS_OL.exe", "TMAS_OLImp.exe", "TMAS_OLSentry.exe",
+        "ufnavi.exe", "Clnrbin.exe", "vizorhtmldialog.exe", "pwmConsole.exe", "PwmSvc.exe", "coreServiceShell.exe",
+        "ds_agent.exe", "SfCtlCom.exe", "MBAMHelper.exe", "cb.exe", "smc.exe", "tda.exe", "xagtnotif.exe", "ekrn.exe",
+        "dsa.exe", "Notifier.exe", "rphcp.exe", "lc_sensor.exe", "CSFalconService.exe", "CSFalconController.exe",
+        "SenseSampleUploader.exe", "windefend.exe", "MSASCui.exe", "MSASCuiL.exe", "msmpeng.exe", "msmpsvc.exe",
+        "MsSense.exe", "esensor.exe", "sentinelone.exe", "tmccsf.exe", "csfalconcontainer.exe", "sensecncproxy.exe",
+        "splunk.exe", "sysmon.exe", "sysmon64.exe", "taniumclient.exe"
+    )] with runs=5
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor.asciidoc
new file mode 100644
index 0000000000..94670a19d6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor]]
+=== Potential Execution via XZBackdoor
+
+It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/amlweems/xzbot
+* https://access.redhat.com/security/cve/CVE-2024-3094
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, user.id with maxspan=1s
+ [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "sshd" and
+    process.args == "-D" and process.args == "-R"] by process.pid, process.entity_id
+ [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name == "sshd" and 
+  process.executable != "/usr/sbin/sshd"] by process.parent.pid, process.parent.entity_id
+ [process where host.os.type == "linux" and event.action == "end" and process.name == "sshd" and process.exit_code != 0] by process.pid, process.entity_id
+ [network where host.os.type == "linux" and event.type == "end" and event.action == "disconnect_received" and process.name == "sshd"] by process.pid, process.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
+* Technique:
+** Name: Remote Service Session Hijacking
+** ID: T1563
+** Reference URL: https://attack.mitre.org/techniques/T1563/
+* Sub-technique:
+** Name: SSH Hijacking
+** ID: T1563.001
+** Reference URL: https://attack.mitre.org/techniques/T1563/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-file-transfer-via-certreq.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-file-transfer-via-certreq.asciidoc
new file mode 100644
index 0000000000..c2773ff6bb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-file-transfer-via-certreq.asciidoc
@@ -0,0 +1,152 @@
+[[prebuilt-rule-8-12-8-potential-file-transfer-via-certreq]]
+=== Potential File Transfer via Certreq
+
+Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lolbas-project.github.io/lolbas/Binaries/Certreq/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Command and Control
+* Tactic: Exfiltration
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential File Transfer via Certreq*
+
+
+Certreq is a command-line utility in Windows operating systems that allows users to request and manage certificates from certificate authorities. It is primarily used for generating certificate signing requests (CSRs) and installing certificates. However, adversaries may abuse Certreq's functionality to download files or upload data to a remote URL by making an HTTP POST request.
+
+This rule identifies the potential abuse of Certreq to download files or upload data to a remote URL.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the details of the dropped file, and whether it was executed.
+- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file from an internal system.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "CertReq.exe" or ?process.pe.original_file_name == "CertReq.exe") and process.args : "-Post"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Web Service
+** ID: T1567
+** Reference URL: https://attack.mitre.org/techniques/T1567/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http.asciidoc
new file mode 100644
index 0000000000..a8d4d39cf3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http.asciidoc
@@ -0,0 +1,88 @@
+[[prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http]]
+=== Potential Local NTLM Relay via HTTP
+
+Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/med0x2e/NTLMRelay2Self
+* https://github.com/topotam/PetitPotam
+* https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "rundll32.exe" and
+
+  /* Rundll32 WbeDav Client  */
+  process.args : ("?:\\Windows\\System32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and
+
+  /* Access to named pipe via http */
+  process.args : ("http*/print/pipe/*", "http*/pipe/spoolss", "http*/pipe/srvsvc")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Exploitation for Credential Access
+** ID: T1212
+** Reference URL: https://attack.mitre.org/techniques/T1212/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse.asciidoc
new file mode 100644
index 0000000000..a32b9b8c98
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse]]
+=== Potential LSA Authentication Package Abuse
+
+Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 105
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Authentication Packages"
+  ) and
+  /* exclude SYSTEM SID - look for changes by non-SYSTEM user */
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Authentication Package
+** ID: T1547.002
+** Reference URL: https://attack.mitre.org/techniques/T1547/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer.asciidoc
new file mode 100644
index 0000000000..02d7891c7f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer.asciidoc
@@ -0,0 +1,217 @@
+[[prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer]]
+=== Potential Masquerading as Business App Installer
+
+Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers
+
+*Tags*: 
+
+* Domain: Endpoint
+* Data Source: Elastic Defend
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Initial Access
+* Tactic: Execution
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and process.executable : "?:\\Users\\*\\Downloads\\*" and
+  not process.code_signature.status : ("errorCode_endpoint*", "errorUntrustedRoot", "errorChaining") and
+  (
+    /* Slack */
+    (process.name : "*slack*.exe" and not
+      (process.code_signature.subject_name in (
+        "Slack Technologies, Inc.",
+        "Slack Technologies, LLC"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "*webex*.exe" and not
+      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "teams*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "*discord*.exe" and not
+      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "*whatsapp*.exe" and not
+      (process.code_signature.subject_name in (
+        "WhatsApp LLC",
+        "WhatsApp, Inc",
+        "24803D75-212C-471A-BC57-9EF86AB91435"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : ("*zoom*installer*.exe", "*zoom*setup*.exe", "zoom.exe")  and not
+      (process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Outlook */
+    (process.name : "*outlook*.exe" and not
+      (
+        (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) or
+        (
+          process.name: "MSOutlookHelp-PST-Viewer.exe" and process.code_signature.subject_name == "Aryson Technologies Pvt. Ltd" and
+          process.code_signature.trusted == true
+        )
+      )
+    ) or
+
+    /* Thunderbird */
+    (process.name : "*thunderbird*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Grammarly */
+    (process.name : "*grammarly*.exe" and not
+      (process.code_signature.subject_name == "Grammarly, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Dropbox */
+    (process.name : "*dropbox*.exe" and not
+      (process.code_signature.subject_name == "Dropbox, Inc" and process.code_signature.trusted == true)
+    ) or
+
+    /* Tableau */
+    (process.name : "*tableau*.exe" and not
+      (process.code_signature.subject_name == "Tableau Software LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Google Drive */
+    (process.name : "*googledrive*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* MSOffice */
+    (process.name : "*office*setup*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Okta */
+    (process.name : "*okta*.exe" and not
+      (process.code_signature.subject_name == "Okta, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* OneDrive */
+    (process.name : "*onedrive*.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Chrome */
+    (process.name : "*chrome*.exe" and not
+      (process.code_signature.subject_name in ("Google LLC", "Google Inc") and process.code_signature.trusted == true)
+    ) or
+
+    /* Firefox */
+    (process.name : "*firefox*.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Edge */
+    (process.name : ("*microsoftedge*.exe", "*msedge*.exe") and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Brave */
+    (process.name : "*brave*.exe" and not
+      (process.code_signature.subject_name == "Brave Software, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* GoogleCloud Related Tools */
+    (process.name : "*GoogleCloud*.exe" and not
+      (process.code_signature.subject_name == "Google LLC" and process.code_signature.trusted == true)
+    ) or
+
+    /* Github Related Tools */
+    (process.name : "*github*.exe" and not
+      (process.code_signature.subject_name == "GitHub, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Notion */
+    (process.name : "*notion*.exe" and not
+      (process.code_signature.subject_name == "Notion Labs, Inc." and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Drive-by Compromise
+** ID: T1189
+** Reference URL: https://attack.mitre.org/techniques/T1189/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps.asciidoc
new file mode 100644
index 0000000000..be75c841d2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps.asciidoc
@@ -0,0 +1,134 @@
+[[prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps]]
+=== Potential Masquerading as Communication Apps
+
+Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and
+  event.type == "start" and
+  (
+    /* Slack */
+    (process.name : "slack.exe" and not
+      (process.code_signature.subject_name in (
+        "Slack Technologies, Inc.",
+        "Slack Technologies, LLC"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* WebEx */
+    (process.name : "WebexHost.exe" and not
+      (process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and process.code_signature.trusted == true)
+    ) or
+
+    /* Teams */
+    (process.name : "Teams.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Discord */
+    (process.name : "Discord.exe" and not
+      (process.code_signature.subject_name == "Discord Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* RocketChat */
+    (process.name : "Rocket.Chat.exe" and not
+      (process.code_signature.subject_name == "Rocket.Chat Technologies Corp." and process.code_signature.trusted == true)
+    ) or
+
+    /* Mattermost */
+    (process.name : "Mattermost.exe" and not
+      (process.code_signature.subject_name == "Mattermost, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* WhatsApp */
+    (process.name : "WhatsApp.exe" and not
+      (process.code_signature.subject_name in (
+        "WhatsApp LLC",
+        "WhatsApp, Inc",
+        "24803D75-212C-471A-BC57-9EF86AB91435"
+       ) and process.code_signature.trusted == true)
+    ) or
+
+    /* Zoom */
+    (process.name : "Zoom.exe" and not
+      (process.code_signature.subject_name == "Zoom Video Communications, Inc." and process.code_signature.trusted == true)
+    ) or
+
+    /* Outlook */
+    (process.name : "outlook.exe" and not
+      (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true)
+    ) or
+
+    /* Thunderbird */
+    (process.name : "thunderbird.exe" and not
+      (process.code_signature.subject_name == "Mozilla Corporation" and process.code_signature.trusted == true)
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Compromise Client Software Binary
+** ID: T1554
+** Reference URL: https://attack.mitre.org/techniques/T1554/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries.asciidoc
new file mode 100644
index 0000000000..d7399c3f54
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries.asciidoc
@@ -0,0 +1,194 @@
+[[prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries]]
+=== Potential Modification of Accessibility Binaries
+
+Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/blog/practical-security-engineering-stateful-detection
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Modification of Accessibility Binaries*
+
+
+Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.
+
+More details can be found https://attack.mitre.org/techniques/T1546/008/[here].
+
+This rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : ("Utilman.exe", "winlogon.exe") and user.name == "SYSTEM" and
+ process.pe.original_file_name : "?*" and
+ process.args :
+    (
+    "C:\\Windows\\System32\\osk.exe",
+    "C:\\Windows\\System32\\Magnify.exe",
+    "C:\\Windows\\System32\\Narrator.exe",
+    "C:\\Windows\\System32\\Sethc.exe",
+    "utilman.exe",
+    "ATBroker.exe",
+    "DisplaySwitch.exe",
+    "sethc.exe"
+    )
+ and not process.pe.original_file_name in
+    (
+    "osk.exe",
+    "sethc.exe",
+    "utilman2.exe",
+    "DisplaySwitch.exe",
+    "ATBroker.exe",
+    "ScreenMagnifier.exe",
+    "SR.exe",
+    "Narrator.exe",
+    "magnify.exe",
+    "MAGNIFY.EXE"
+    )
+
+/* uncomment once in winlogbeat to avoid bypass with rogue process with matching pe original file name */
+/* and process.code_signature.subject_name == "Microsoft Windows" and process.code_signature.status == "trusted" */
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Accessibility Features
+** ID: T1546.008
+** Reference URL: https://attack.mitre.org/techniques/T1546/008/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification.asciidoc
new file mode 100644
index 0000000000..d84c3b9fdd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification.asciidoc
@@ -0,0 +1,156 @@
+[[prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification]]
+=== Potential Persistence via Time Provider Modification
+
+Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://pentestlab.blog/2019/10/22/persistence-time-providers/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Persistence via Time Provider Modification*
+
+
+The Time Provider architecture in Windows is responsible for obtaining accurate timestamps from network devices or clients. It is implemented as a DLL file in the System32 folder and is initiated by the W32Time service during Windows startup. Adversaries may exploit this by registering and enabling a malicious DLL as a time provider to establish persistence. 
+
+This rule identifies changes in the registry paths associated with Time Providers, specifically targeting the addition of new DLL files.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine whether the DLL is signed.
+- Retrieve the DLL and determine if it is malicious:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restore Time Provider settings to the desired state.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type:"change" and
+  registry.path: (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\W32Time\\TimeProviders\\*",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\W32Time\\TimeProviders\\*"
+  ) and
+  registry.data.strings:"*.dll" and
+  not
+  (
+    process.executable : "?:\\Windows\\System32\\msiexec.exe" and
+    registry.data.strings : "?:\\Program Files\\VMware\\VMware Tools\\vmwTimeProvider\\vmwTimeProvider.dll"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Time Providers
+** ID: T1547.003
+** Reference URL: https://attack.mitre.org/techniques/T1547/003/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Time Providers
+** ID: T1547.003
+** Reference URL: https://attack.mitre.org/techniques/T1547/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse.asciidoc
new file mode 100644
index 0000000000..41b9ef852f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse]]
+=== Potential Port Monitor or Print Processor Registration Abuse
+
+Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  registry.path : (
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*",
+      "HKLM\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Print\\Monitors\\*",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Print\\Environments\\Windows*\\Print Processors\\*"
+  ) and registry.data.strings : "*.dll" and
+  /* exclude SYSTEM SID - look for changes by non-SYSTEM user */
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Port Monitors
+** ID: T1547.010
+** Reference URL: https://attack.mitre.org/techniques/T1547/010/
+* Sub-technique:
+** Name: Print Processors
+** ID: T1547.012
+** Reference URL: https://attack.mitre.org/techniques/T1547/012/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Port Monitors
+** ID: T1547.010
+** Reference URL: https://attack.mitre.org/techniques/T1547/010/
+* Sub-technique:
+** Name: Print Processors
+** ID: T1547.012
+** Reference URL: https://attack.mitre.org/techniques/T1547/012/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names.asciidoc
new file mode 100644
index 0000000000..b1f85b619a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -0,0 +1,353 @@
+[[prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names]]
+=== Potential PowerShell HackTool Script by Function Names
+
+Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+* https://github.com/BC-SECURITY/Empire
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: PowerShell Logs
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential PowerShell HackTool Script by Function Names*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Adversaries often exploit PowerShell's capabilities to execute malicious scripts and perform various attacks. This rule identifies known offensive tooling function names in PowerShell scripts, as attackers commonly use out-of-the-box tools without modifying the code. By monitoring these specific function names, the rule aims to detect and alert potential malicious PowerShell activity.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the script's execution context, such as the user account, privileges, the role of the system on which it was executed, and any relevant timestamps.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Investigate the origin of the PowerShell script, including its source, download method, and any associated URLs or IP addresses.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process's `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This rule may generate false positives if legitimate scripts or tools used by administrators contain any of the listed function names. These function names are commonly associated with offensive tooling, but they may also be present in benign scripts or tools.
+- To handle these false positives consider adding exceptions - preferably with a combination of full file path and users.
+
+
+*Related Rules*
+
+
+- PowerShell Invoke-NinjaCopy script - b8386923-b02c-4b94-986a-d223d9b01f88
+- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - If malicious activity is confirmed, perform a broader investigation to identify the scope of the compromise and determine the appropriate remediation steps.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "Add-DomainGroupMember" or "Add-DomainObjectAcl" or
+    "Add-RemoteConnection" or "Add-ServiceDacl" or
+    "Add-Win32Type" or "Convert-ADName" or
+    "Convert-LDAPProperty" or "ConvertFrom-LDAPLogonHours" or
+    "ConvertFrom-UACValue" or "Copy-ArrayOfMemAddresses" or
+    "Create-NamedPipe" or "Create-ProcessWithToken" or
+    "Create-RemoteThread" or "Create-SuspendedWinLogon" or
+    "Create-WinLogonProcess" or "Emit-CallThreadStub" or
+    "Enable-SeAssignPrimaryTokenPrivilege" or "Enable-SeDebugPrivilege" or
+    "Enum-AllTokens" or "Export-PowerViewCSV" or
+    "Find-AVSignature" or "Find-AppLockerLog" or
+    "Find-DomainLocalGroupMember" or "Find-DomainObjectPropertyOutlier" or
+    "Find-DomainProcess" or "Find-DomainShare" or
+    "Find-DomainUserEvent" or "Find-DomainUserLocation" or
+    "Find-InterestingDomainAcl" or "Find-InterestingDomainShareFile" or
+    "Find-InterestingFile" or "Find-LocalAdminAccess" or
+    "Find-PSScriptsInPSAppLog" or "Find-PathDLLHijack" or
+    "Find-ProcessDLLHijack" or "Find-RDPClientConnection" or
+    "Get-AllAttributesForClass" or "Get-CachedGPPPassword" or
+    "Get-DecryptedCpassword" or "Get-DecryptedSitelistPassword" or
+    "Get-DelegateType" or "New-RelayEnumObject" or
+    "Get-DomainDFSShare" or "Get-DomainDFSShareV1" or
+    "Get-DomainDFSShareV2" or "Get-DomainDNSRecord" or
+    "Get-DomainDNSZone" or "Get-DomainFileServer" or
+    "Get-DomainForeignGroupMember" or "Get-DomainForeignUser" or
+    "Get-DomainGPO" or "Get-DomainGPOComputerLocalGroupMapping" or
+    "Get-DomainGPOLocalGroup" or "Get-DomainGPOUserLocalGroupMapping" or
+    "Get-DomainGUIDMap" or "Get-DomainGroup" or
+    "Get-DomainGroupMember" or "Get-DomainGroupMemberDeleted" or
+    "Get-DomainManagedSecurityGroup" or "Get-DomainOU" or
+    "Get-DomainObject" or "Get-DomainObjectAcl" or
+    "Get-DomainObjectAttributeHistory" or "Get-DomainObjectLinkedAttributeHistory" or
+    "Get-DomainPolicyData" or "Get-DomainSID" or
+    "Get-DomainSPNTicket" or "Get-DomainSearcher" or
+    "Get-DomainSite" or "Get-DomainSubnet" or
+    "Get-DomainTrust" or "Get-DomainTrustMapping" or
+    "Get-DomainUser" or "Get-DomainUserEvent" or
+    "Get-Forest" or "Get-ForestDomain" or
+    "Get-ForestGlobalCatalog" or "Get-ForestSchemaClass" or
+    "Get-ForestTrust" or "Get-GPODelegation" or
+    "Get-GPPAutologon" or "Get-GPPInnerField" or
+    "Get-GPPInnerFields" or "Get-GPPPassword" or
+    "Get-GptTmpl" or "Get-GroupsXML" or
+    "Get-HttpStatus" or "Get-ImageNtHeaders" or
+    "Get-Keystrokes" or "New-SOASerialNumberArray" or 
+    "Get-MemoryProcAddress" or "Get-MicrophoneAudio" or
+    "Get-ModifiablePath" or "Get-ModifiableRegistryAutoRun" or
+    "Get-ModifiableScheduledTaskFile" or "Get-ModifiableService" or
+    "Get-ModifiableServiceFile" or "Get-Name" or
+    "Get-NetComputerSiteName" or "Get-NetLocalGroup" or
+    "Get-NetLocalGroupMember" or "Get-NetLoggedon" or
+    "Get-NetRDPSession" or "Get-NetSession" or
+    "Get-NetShare" or "Get-PEArchitecture" or
+    "Get-PEBasicInfo" or "Get-PEDetailedInfo" or
+    "Get-PathAcl" or "Get-PrimaryToken" or
+    "Get-ProcAddress" or "Get-ProcessTokenGroup" or
+    "Get-ProcessTokenPrivilege" or "Get-ProcessTokenType" or
+    "Get-RegLoggedOn" or "Get-RegistryAlwaysInstallElevated" or
+    "Get-RegistryAutoLogon" or "Get-RemoteProcAddress" or
+    "Get-Screenshot" or "Get-ServiceDetail" or
+    "Get-SiteListPassword" or "Get-SitelistField" or
+    "Get-System" or "Get-SystemNamedPipe" or
+    "Get-SystemToken" or "Get-ThreadToken" or
+    "Get-TimedScreenshot" or "Get-TokenInformation" or
+    "Get-TopPort" or "Get-UnattendedInstallFile" or
+    "Get-UniqueTokens" or "Get-UnquotedService" or
+    "Get-VaultCredential" or "Get-VaultElementValue" or
+    "Get-VirtualProtectValue" or "Get-VolumeShadowCopy" or
+    "Get-WMIProcess" or "Get-WMIRegCachedRDPConnection" or
+    "Get-WMIRegLastLoggedOn" or "Get-WMIRegMountedDrive" or
+    "Get-WMIRegProxy" or "Get-WebConfig" or
+    "Get-Win32Constants" or "Get-Win32Functions" or
+    "Get-Win32Types" or "Import-DllImports" or
+    "Import-DllInRemoteProcess" or "Inject-LocalShellcode" or
+    "Inject-RemoteShellcode" or "Install-ServiceBinary" or
+    "Invoke-CompareAttributesForClass" or "Invoke-CreateRemoteThread" or
+    "Invoke-CredentialInjection" or "Invoke-DllInjection" or
+    "Invoke-EventVwrBypass" or "Invoke-ImpersonateUser" or
+    "Invoke-Kerberoast" or "Invoke-MemoryFreeLibrary" or
+    "Invoke-MemoryLoadLibrary" or
+    "Invoke-Mimikatz" or "Invoke-NinjaCopy" or
+    "Invoke-PatchDll" or "Invoke-Portscan" or
+    "Invoke-PrivescAudit" or "Invoke-ReflectivePEInjection" or
+    "Invoke-ReverseDnsLookup" or "Invoke-RevertToSelf" or
+    "Invoke-ServiceAbuse" or "Invoke-Shellcode" or
+    "Invoke-TokenManipulation" or "Invoke-UserImpersonation" or
+    "Invoke-WmiCommand" or "Mount-VolumeShadowCopy" or
+    "New-ADObjectAccessControlEntry" or "New-DomainGroup" or
+    "New-DomainUser" or "New-DynamicParameter" or
+    "New-InMemoryModule" or
+    "New-ThreadedFunction" or "New-VolumeShadowCopy" or
+    "Out-CompressedDll" or "Out-EncodedCommand" or
+    "Out-EncryptedScript" or "Out-Minidump" or
+    "PortScan-Alive" or "Portscan-Port" or
+    "Remove-DomainGroupMember" or "Remove-DomainObjectAcl" or
+    "Remove-RemoteConnection" or "Remove-VolumeShadowCopy" or
+    "Restore-ServiceBinary" or "Set-DesktopACLToAllowEveryone" or
+    "Set-DesktopACLs" or "Set-DomainObject" or
+    "Set-DomainObjectOwner" or "Set-DomainUserPassword" or
+    "Set-ServiceBinaryPath" or "Sub-SignedIntAsUnsigned" or
+    "Test-AdminAccess" or "Test-MemoryRangeValid" or
+    "Test-ServiceDaclPermission" or "Update-ExeFunctions" or
+    "Update-MemoryAddresses" or "Update-MemoryProtectionFlags" or
+    "Write-BytesToMemory" or "Write-HijackDll" or
+    "Write-PortscanOut" or "Write-ServiceBinary" or
+    "Write-UserAddMSI" or "Invoke-Privesc" or
+    "func_get_proc_address" or "Invoke-BloodHound" or
+    "Invoke-HostEnum" or "Get-BrowserInformation" or
+    "Get-DomainAccountPolicy" or "Get-DomainAdmins" or
+    "Get-AVProcesses" or "Get-AVInfo" or
+    "Get-RecycleBin" or "Invoke-BruteForce" or
+    "Get-PassHints" or "Invoke-SessionGopher" or
+    "Get-LSASecret" or "Get-PassHashes" or
+    "Invoke-WdigestDowngrade" or "Get-ChromeDump" or
+    "Invoke-DomainPasswordSpray" or "Get-FoxDump" or
+    "New-HoneyHash" or "Invoke-DCSync" or
+    "Invoke-PowerDump" or "Invoke-SSIDExfil" or
+    "Invoke-PowerShellTCP" or "Add-Exfiltration" or
+    "Do-Exfiltration" or "Invoke-DropboxUpload" or
+    "Invoke-ExfilDataToGitHub" or "Invoke-EgressCheck" or
+    "Invoke-PostExfil" or "Create-MultipleSessions" or
+    "Invoke-NetworkRelay" or "New-GPOImmediateTask" or
+    "Invoke-WMIDebugger" or "Invoke-SQLOSCMD" or
+    "Invoke-SMBExec" or "Invoke-PSRemoting" or
+    "Invoke-ExecuteMSBuild" or "Invoke-DCOM" or
+    "Invoke-InveighRelay" or "Invoke-PsExec" or
+    "Invoke-SSHCommand" or "Find-ActiveUsersWMI" or
+    "Get-SystemDrivesWMI" or "Get-ActiveNICSWMI" or
+    "Remove-Persistence" or "DNS_TXT_Pwnage" or
+    "Execute-OnTime" or "HTTP-Backdoor" or
+    "Add-ConstrainedDelegationBackdoor" or "Add-RegBackdoor" or
+    "Add-ScrnSaveBackdoor" or "Gupt-Backdoor" or
+    "Invoke-ADSBackdoor" or "Add-Persistence" or
+    "Invoke-ResolverBackdoor" or "Invoke-EventLogBackdoor" or
+    "Invoke-DeadUserBackdoor" or "Invoke-DisableMachineAcctChange" or
+    "Invoke-AccessBinary" or "Add-NetUser" or
+    "Invoke-Schtasks" or "Invoke-JSRatRegsvr" or
+    "Invoke-JSRatRundll" or "Invoke-PoshRatHttps" or
+    "Invoke-PsGcatAgent" or "Remove-PoshRat" or
+    "Install-SSP" or "Invoke-BackdoorLNK" or
+    "PowerBreach" or "InstallEXE-Persistence" or
+    "RemoveEXE-Persistence" or "Install-ServiceLevel-Persistence" or
+    "Remove-ServiceLevel-Persistence" or "Invoke-Prompt" or
+    "Invoke-PacketCapture" or "Start-WebcamRecorder" or
+    "Get-USBKeyStrokes" or "Invoke-KeeThief" or
+    "Get-Keystrokes" or "Invoke-NetRipper" or
+    "Get-EmailItems" or "Invoke-MailSearch" or
+    "Invoke-SearchGAL" or "Get-WebCredentials" or
+    "Start-CaptureServer" or "Invoke-PowerShellIcmp" or
+    "Invoke-PowerShellTcpOneLine" or "Invoke-PowerShellTcpOneLineBind" or
+    "Invoke-PowerShellUdp" or "Invoke-PowerShellUdpOneLine" or
+    "Run-EXEonRemote" or "Download-Execute-PS" or
+    "Out-RundllCommand" or "Set-RemoteWMI" or
+    "Set-DCShadowPermissions" or "Invoke-PowerShellWMI" or
+    "Invoke-Vnc" or "Invoke-LockWorkStation" or
+    "Invoke-EternalBlue" or "Invoke-ShellcodeMSIL" or
+    "Invoke-MetasploitPayload" or "Invoke-DowngradeAccount" or
+    "Invoke-RunAs" or "ExetoText" or
+    "Disable-SecuritySettings" or "Set-MacAttribute" or
+    "Invoke-MS16032" or "Invoke-BypassUACTokenManipulation" or
+    "Invoke-SDCLTBypass" or "Invoke-FodHelperBypass" or
+    "Invoke-EventVwrBypass" or "Invoke-EnvBypass" or
+    "Get-ServiceUnquoted" or "Get-ServiceFilePermission" or
+    "Get-ServicePermission" or
+    "Enable-DuplicateToken" or "Invoke-PsUaCme" or
+    "Invoke-Tater" or "Invoke-WScriptBypassUAC" or
+    "Invoke-AllChecks" or "Find-TrustedDocuments" or
+    "Invoke-Interceptor" or "Invoke-PoshRatHttp" or
+    "Invoke-ExecCommandWMI" or "Invoke-KillProcessWMI" or
+    "Invoke-CreateShareandExecute" or "Invoke-RemoteScriptWithOutput" or
+    "Invoke-SchedJobManipulation" or "Invoke-ServiceManipulation" or
+    "Invoke-PowerOptionsWMI" or "Invoke-DirectoryListing" or
+    "Invoke-FileTransferOverWMI" or "Invoke-WMImplant" or
+    "Invoke-WMIObfuscatedPSCommand" or "Invoke-WMIDuplicateClass" or
+    "Invoke-WMIUpload" or "Invoke-WMIRemoteExtract" or "Invoke-winPEAS"
+  ) and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint"
+  ) and
+  not user.id : ("S-1-5-18" or "S-1-5-19")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script.asciidoc
new file mode 100644
index 0000000000..50089c99b2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script]]
+=== Potential PowerShell Pass-the-Hash/Relay Script
+
+Detects PowerShell scripts that can execute pass-the-hash (PtH) attacks, intercept and relay NTLM challenges, and carry out other man-in-the-middle (MitM) attacks.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-WMIExec.ps1
+* https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1
+* https://github.com/dafthack/Check-LocalAdminHash/blob/master/Check-LocalAdminHash.ps1
+* https://github.com/nettitude/PoshC2/blob/master/resources/modules/Invoke-Tater.ps1
+* https://github.com/Kevin-Robertson/Inveigh/blob/master/Inveigh.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    ("NTLMSSPNegotiate" and ("NegotiateSMB" or "NegotiateSMB2")) or
+    "4E544C4D53535000" or
+    "0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50" or
+    "0x4e,0x54,0x20,0x4c,0x4d" or
+    "0x53,0x4d,0x42,0x20,0x32" or
+    "0x81,0xbb,0x7a,0x36,0x44,0x98,0xf1,0x35,0xad,0x32,0x98,0xf0,0x38"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Pass the Hash
+** ID: T1550.002
+** Reference URL: https://attack.mitre.org/techniques/T1550/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover.asciidoc
new file mode 100644
index 0000000000..be370074f2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -0,0 +1,164 @@
+[[prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover]]
+=== Potential Privilege Escalation via InstallerFileTakeOver
+
+Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/klinix5/InstallerFileTakeOver
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Privilege Escalation via InstallerFileTakeOver*
+
+
+InstallerFileTakeOver is a weaponized escalation of privilege proof of concept (EoP PoC) to the CVE-2021-41379 vulnerability. Upon successful exploitation, an unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.
+
+This rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Look for additional processes spawned by the process, command lines, and network communications.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- Verify whether a digital signature exists in the executable, and if it is valid.
+
+
+*Related rules*
+
+
+- Suspicious DLL Loaded for Persistence or Privilege Escalation - bfeaf89b-a2a7-48a3-817f-e41829dc61ee
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    process.Ext.token.integrity_level_name : "System" and
+    (
+      (process.name : "elevation_service.exe" and
+       not process.pe.original_file_name == "elevation_service.exe") or
+      
+      (process.name : "elevation_service.exe" and
+       not process.code_signature.trusted == true) or
+
+      (process.parent.name : "elevation_service.exe" and
+       process.name : ("rundll32.exe", "cmd.exe", "powershell.exe"))
+    ) and
+    not
+    (
+      process.name : "elevation_service.exe" and process.code_signature.trusted == true and
+      process.pe.original_file_name == null
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry.asciidoc
new file mode 100644
index 0000000000..a97c3cdcec
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry.asciidoc
@@ -0,0 +1,146 @@
+[[prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry]]
+=== Potential Remote Credential Access via Registry
+
+Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Remote Credential Access via Registry*
+
+
+Dumping registry hives is a common way to access credential information. Some hives store credential material, such as the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
+
+Attackers can use tools like secretsdump.py or CrackMapExec to dump the registry hives remotely, and use dumped credentials to access other systems in the domain.
+
+
+*Possible investigation steps*
+
+
+- Identify the specifics of the involved assets, such as their role, criticality, and associated users.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Determine the privileges of the compromised accounts.
+- Investigate other alerts associated with the user/source host during the past 48 hours.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Related rules*
+
+
+- Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine if other hosts were compromised.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Reimage the host operating system or restore the compromised files to clean versions.
+- Ensure that the machine has the latest security updates and is not running unsupported Windows versions.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+This rule uses Elastic Endpoint file creation and system integration events for correlation. Both data should be collected from the host for this detection to work.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and
+  event.action == "creation" and process.name : "svchost.exe" and
+  file.Ext.header_bytes : "72656766*" and user.id : ("S-1-5-21-*", "S-1-12-1-*") and file.size >= 30000 and
+  file.path : ("?:\\Windows\\system32\\*.tmp", "?:\\WINDOWS\\Temp\\*.tmp")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected.asciidoc
new file mode 100644
index 0000000000..2333c9c6c8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected]]
+=== Potential Remote Desktop Tunneling Detected
+
+Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Remote Desktop Tunneling Detected*
+
+
+Protocol Tunneling is a mechanism that involves explicitly encapsulating a protocol within another for various use cases, ranging from providing an outer layer of encryption (similar to a VPN) to enabling traffic that network appliances would filter to reach their destination.
+
+Attackers may tunnel Remote Desktop Protocol (RDP) traffic through other protocols like Secure Shell (SSH) to bypass network restrictions that block incoming RDP connections but may be more permissive to other protocols.
+
+This rule looks for command lines involving the `3389` port, which RDP uses by default and options commonly associated with tools that perform tunneling.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account and system owners and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine network data to determine if the host communicated with external servers using the tunnel.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+- Investigate the command line for the execution of programs that are unrelated to tunneling, like Remote Desktop clients.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Take the necessary actions to disable the tunneling, which can be a process kill, service deletion, registry key modification, etc. Inspect the host to learn which method was used and to determine a response for the case.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  /* RDP port and usual SSH tunneling related switches in command line */
+  process.args : "*:3389" and
+  process.args : ("-L", "-P", "-R", "-pw", "-ssh")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Protocol Tunneling
+** ID: T1572
+** Reference URL: https://attack.mitre.org/techniques/T1572/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility.asciidoc
new file mode 100644
index 0000000000..af19add00c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility]]
+=== Potential Secure File Deletion via SDelete Utility
+
+Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Impact
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Potential Secure File Deletion via SDelete Utility*
+
+
+SDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.
+
+This rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.
+
+
+*False positive analysis*
+
+
+- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If important data was encrypted, deleted, or modified, activate your data recovery plan.
+    - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "change" and file.name : "*AAA.AAA"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indicator Removal
+** ID: T1070
+** Reference URL: https://attack.mitre.org/techniques/T1070/
+* Sub-technique:
+** Name: File Deletion
+** ID: T1070.004
+** Reference URL: https://attack.mitre.org/techniques/T1070/004/
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-psreflect-script.asciidoc
new file mode 100644
index 0000000000..6ce963e19a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-psreflect-script.asciidoc
@@ -0,0 +1,191 @@
+[[prebuilt-rule-8-12-8-powershell-psreflect-script]]
+=== PowerShell PSReflect Script
+
+Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/mattifestation/PSReflect/blob/master/PSReflect.psm1
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell PSReflect Script*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+PSReflect is a library that enables PowerShell to access win32 API functions in an uncomplicated way. It also helps to create enums and structs easily—all without touching the disk.
+
+Although this is an interesting project for every developer and admin out there, it is mainly used in the red team and malware tooling for its capabilities.
+
+Detecting the core implementation of PSReflect means detecting most of the tooling that uses Windows API through PowerShell, enabling defenders to discover tools being dropped in the environment.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics. The script content that may be split into multiple script blocks (you can use the field `powershell.file.script_block_id` for filtering).
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Check for additional PowerShell and command-line logs that indicate that imported functions were run.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related rules*
+
+
+- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
+- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
+- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be configured (Enable).
+
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text:(
+    "New-InMemoryModule" or
+    "Add-Win32Type" or
+    psenum or
+    DefineDynamicAssembly or
+    DefineDynamicModule or
+    "Reflection.TypeAttributes" or
+    "Reflection.Emit.OpCodes" or
+    "Reflection.Emit.CustomAttributeBuilder" or
+    "Runtime.InteropServices.DllImportAttribute"
+  ) and
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-script-block-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-script-block-logging-disabled.asciidoc
new file mode 100644
index 0000000000..b94584847b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-script-block-logging-disabled.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-12-8-powershell-script-block-logging-disabled]]
+=== PowerShell Script Block Logging Disabled
+
+Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScriptBlockLogging
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Script Block Logging Disabled*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available in various environments and creating an attractive way for attackers to execute code.
+
+PowerShell Script Block Logging is a feature of PowerShell that records the content of all script blocks that it processes, giving defenders visibility of PowerShell scripts and sequences of executed commands.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether it makes sense for the user to use PowerShell to complete tasks.
+- Investigate if PowerShell scripts were run after logging was disabled.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related rules*
+
+
+- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
+- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
+- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+    registry.path : (
+        "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging",
+        "\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\\EnableScriptBlockLogging"
+    ) and registry.data.strings : ("0", "0x00000000")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable Windows Event Logging
+** ID: T1562.002
+** Reference URL: https://attack.mitre.org/techniques/T1562/002/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions.asciidoc
new file mode 100644
index 0000000000..751cc96c5c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions.asciidoc
@@ -0,0 +1,210 @@
+[[prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions]]
+=== PowerShell Suspicious Discovery Related Windows API Functions
+
+This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413
+* https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Tactic: Collection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 213
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Discovery Related Windows API Functions*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries like PSReflect or Get-ProcAddress Cmdlet.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Check for additional PowerShell and command-line logs that indicate that imported functions were run.
+
+
+*False positive analysis*
+
+
+- Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not contain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed. However, analysts should keep in mind that this is not a common way of getting information, making it suspicious.
+
+
+*Related rules*
+
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    NetShareEnum or
+    NetWkstaUserEnum or
+    NetSessionEnum or
+    NetLocalGroupEnum or
+    NetLocalGroupGetMembers or
+    DsGetSiteName or
+    DsEnumerateDomainTrusts or
+    WTSEnumerateSessionsEx or
+    WTSQuerySessionInformation or
+    LsaGetLogonSessionData or
+    QueryServiceObjectSecurity or
+    GetComputerNameEx or
+    NetWkstaGetInfo or
+    GetUserNameEx or
+    NetUserEnum or
+    NetUserGetInfo or
+    NetGroupEnum or
+    NetGroupGetInfo or
+    NetGroupGetUsers or
+    NetWkstaTransportEnum or
+    NetServerGetInfo or
+    LsaEnumerateTrustedDomains  or
+    NetScheduleJobEnum or
+    NetUserModalsGet
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
+* Sub-technique:
+** Name: Local Groups
+** ID: T1069.001
+** Reference URL: https://attack.mitre.org/techniques/T1069/001/
+* Technique:
+** Name: Account Discovery
+** ID: T1087
+** Reference URL: https://attack.mitre.org/techniques/T1087/
+* Sub-technique:
+** Name: Local Account
+** ID: T1087.001
+** Reference URL: https://attack.mitre.org/techniques/T1087/001/
+* Technique:
+** Name: Domain Trust Discovery
+** ID: T1482
+** Reference URL: https://attack.mitre.org/techniques/T1482/
+* Technique:
+** Name: Network Share Discovery
+** ID: T1135
+** Reference URL: https://attack.mitre.org/techniques/T1135/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Data from Network Shared Drive
+** ID: T1039
+** Reference URL: https://attack.mitre.org/techniques/T1039/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed.asciidoc
new file mode 100644
index 0000000000..8d2e769384
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -0,0 +1,186 @@
+[[prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed]]
+=== PowerShell Suspicious Payload Encoded and Compressed
+
+Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Payload Encoded and Compressed*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
+
+
+*Related rules*
+
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    (
+      "System.IO.Compression.DeflateStream" or
+      "System.IO.Compression.GzipStream" or
+      "IO.Compression.DeflateStream" or
+      "IO.Compression.GzipStream"
+    ) and
+    FromBase64String
+  ) and
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
new file mode 100644
index 0000000000..6ce0e6b3ac
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -0,0 +1,171 @@
+[[prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities]]
+=== PowerShell Suspicious Script with Clipboard Retrieval Capabilities
+
+Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard
+* https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: PowerShell Logs
+* Resources: Investigation Guide
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Determine whether the script stores the captured data locally.
+- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.
+- Assess network data to determine if the host communicated with the exfiltration server.
+
+
+*False positive analysis*
+
+
+- Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+
+*Related rules*
+
+
+- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  (powershell.file.script_block_text : (
+    "Windows.Clipboard" or
+    "Windows.Forms.Clipboard" or
+    "Windows.Forms.TextBox"
+   ) and
+   powershell.file.script_block_text : (
+    "]::GetText" or
+    ".Paste()"
+  )) or powershell.file.script_block_text : "Get-Clipboard" and
+  not powershell.file.script_block_text : (
+    "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
+  ) and
+  not user.id : "S-1-5-18" and
+  not (
+    file.path : C\:\\Program?Files\\WindowsPowerShell\\*Modules*.ps1 and
+    file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Clipboard Data
+** ID: T1115
+** Reference URL: https://attack.mitre.org/techniques/T1115/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation.asciidoc
new file mode 100644
index 0000000000..fd5f0dc2bc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -0,0 +1,149 @@
+[[prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation]]
+=== Privilege Escalation via Named Pipe Impersonation
+
+Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation
+* https://www.cobaltstrike.com/blog/what-happens-when-i-type-getsystem/
+* https://redcanary.com/blog/getsystem-offsec/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Privilege Escalation via Named Pipe Impersonation*
+
+
+A named pipe is a type of inter-process communication (IPC) mechanism used in operating systems like Windows, which allows two or more processes to communicate with each other by sending and receiving data through a well-known point.
+
+Attackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - If any suspicious processes were found, examine the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : ("Cmd.Exe", "PowerShell.EXE") or ?process.pe.original_file_name in ("Cmd.Exe", "PowerShell.EXE")) and
+ process.args : "echo" and process.args : ">" and process.args : "\\\\.\\pipe\\*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable.asciidoc
new file mode 100644
index 0000000000..e2ebdd4532
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable.asciidoc
@@ -0,0 +1,77 @@
+[[prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable]]
+=== Privilege Escalation via Windir Environment Variable
+
+Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKEY_USERS\\*\\Environment\\windir",
+    "HKEY_USERS\\*\\Environment\\systemroot",
+    "HKU\\*\\Environment\\windir",
+    "HKU\\*\\Environment\\systemroot",
+    "\\REGISTRY\\USER\\*\\Environment\\windir",
+    "\\REGISTRY\\USER\\*\\Environment\\systemroot"
+    ) and
+ not registry.data.strings : ("C:\\windows", "%SystemRoot%")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: Path Interception by PATH Environment Variable
+** ID: T1574.007
+** Reference URL: https://attack.mitre.org/techniques/T1574/007/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc
new file mode 100644
index 0000000000..2a8d0a3a5b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc
@@ -0,0 +1,130 @@
+[[prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing]]
+=== Privileges Elevation via Parent Process PID Spoofing
+
+Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6
+* https://blog.didierstevens.com/2017/03/20/
+* https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute
+* https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is compatible with Elastic Endpoint only */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ /* process creation via seclogon */
+ process.parent.Ext.real.pid > 0 and
+
+ /* PrivEsc to SYSTEM */
+ user.id : "S-1-5-18"  and
+
+ /* Common FPs - evasion via hollowing is possible, should be covered by code injection */
+ not process.executable : ("?:\\Windows\\System32\\WerFault.exe",
+                           "?:\\Windows\\SysWOW64\\WerFault.exe",
+                           "?:\\Windows\\System32\\WerFaultSecure.exe",
+                           "?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
+                           "?:\\Windows\\System32\\Wermgr.exe",
+                           "?:\\Windows\\SysWOW64\\Wermgr.exe",
+                           "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
+ /* Logon Utilities */
+ not (process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
+     process.executable : ("?:\\Windows\\System32\\osk.exe",
+                           "?:\\Windows\\System32\\Narrator.exe",
+                           "?:\\Windows\\System32\\Magnify.exe")) and
+
+ not process.parent.executable : "?:\\Windows\\System32\\AtBroker.exe" and
+
+ not (process.code_signature.subject_name in
+           ("philandro Software GmbH", "Freedom Scientific Inc.", "TeamViewer Germany GmbH", "Projector.is, Inc.",
+            "TeamViewer GmbH", "Cisco WebEx LLC", "Dell Inc") and process.code_signature.trusted == true) and 
+
+ /* AM_Delta_Patch Windows Update */
+ not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and
+      process.parent.executable : ("?:\\Windows\\System32\\wuauclt.exe", 
+                                   "?:\\Windows\\SysWOW64\\wuauclt.exe", 
+                                   "?:\\Windows\\UUS\\Packages\\Preview\\*\\wuaucltcore.exe", 
+                                   "?:\\Windows\\UUS\\amd64\\wuauclt.exe", 
+                                   "?:\\Windows\\UUS\\amd64\\wuaucltcore.exe", 
+                                   "?:\\ProgramData\\Microsoft\\Windows\\UUS\\*\\wuaucltcore.exe")) and
+ not (process.executable : ("?:\\Windows\\System32\\MpSigStub.exe", "?:\\Windows\\SysWOW64\\MpSigStub.exe") and process.parent.executable == null) and
+
+ /* Other third party SW */
+ not process.parent.executable :
+                   ("?:\\Program Files (x86)\\HEAT Software\\HEAT Remote\\HEATRemoteServer.exe",
+                    "?:\\Program Files (x86)\\VisualCron\\VisualCronService.exe",
+                    "?:\\Program Files\\BinaryDefense\\Vision\\Agent\\bds-vision-agent-app.exe",
+                    "?:\\Program Files\\Tablet\\Wacom\\WacomHost.exe",
+                    "?:\\Program Files (x86)\\LogMeIn\\x64\\LogMeIn.exe",
+                    "?:\\Program Files (x86)\\EMC Captiva\\Captiva Cloud Runtime\\Emc.Captiva.WebCaptureRunner.exe",
+                    "?:\\Program Files\\Freedom Scientific\\*.exe",
+                    "?:\\Program Files (x86)\\Google\\Chrome Remote Desktop\\*\\remoting_host.exe",
+                    "?:\\Program Files (x86)\\GoToAssist Remote Support Customer\\*\\g2ax_comm_customer.exe") and
+ not (
+    process.code_signature.trusted == true and process.code_signature.subject_name == "Netwrix Corporation" and
+    process.name : "adcrcpy.exe" and process.parent.executable : (
+      "?:\\Program Files (x86)\\Netwrix Auditor\\Active Directory Auditing\\Netwrix.ADA.EventCollector.exe",
+      "?:\\Program Files (x86)\\Netwrix Auditor\\Active Directory Auditing\\Netwrix.ADA.Analyzer.exe",
+      "?:\\Netwrix Auditor\\Active Directory Auditing\\Netwrix.ADA.EventCollector.exe"
+    )
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
+* Sub-technique:
+** Name: Parent PID Spoofing
+** ID: T1134.004
+** Reference URL: https://attack.mitre.org/techniques/T1134/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-activity-via-compiled-html-file.asciidoc
new file mode 100644
index 0000000000..9a837cec0a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-activity-via-compiled-html-file.asciidoc
@@ -0,0 +1,168 @@
+[[prebuilt-rule-8-12-8-process-activity-via-compiled-html-file]]
+=== Process Activity via Compiled HTML File
+
+Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Process Activity via Compiled HTML File*
+
+
+CHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.
+
+When users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate the parent process to gain understanding of what triggered this behavior.
+  - Retrieve `.chm`, `.ps1`, and other files that were involved to further examination.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executables, scripts and help files retrieved from the system using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "hh.exe" and
+ process.name : ("mshta.exe", "cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "cscript.exe", "wscript.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: User Execution
+** ID: T1204
+** Reference URL: https://attack.mitre.org/techniques/T1204/
+* Sub-technique:
+** Name: Malicious File
+** ID: T1204.002
+** Reference URL: https://attack.mitre.org/techniques/T1204/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Compiled HTML File
+** ID: T1218.001
+** Reference URL: https://attack.mitre.org/techniques/T1218/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-a-duplicated-token.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-a-duplicated-token.asciidoc
new file mode 100644
index 0000000000..920baccb17
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-a-duplicated-token.asciidoc
@@ -0,0 +1,95 @@
+[[prebuilt-rule-8-12-8-process-created-with-a-duplicated-token]]
+=== Process Created with a Duplicated Token
+
+Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is only compatible with Elastic Endpoint 8.4+ */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ user.id : ("S-1-5-21-*", "S-1-12-1-*") and
+
+ (process.Ext.effective_parent.executable regex~ """[C-Z]:\\Windows\\(System32|SysWOW64)\\[a-zA-Z0-9\-\_\.]+\.exe""" or
+  process.Ext.effective_parent.executable : "?:\\Windows\\explorer.exe") and
+
+ (
+  process.name : ("powershell.exe", "cmd.exe", "rundll32.exe", "notepad.exe", "net.exe", "ntdsutil.exe",
+                  "tasklist.exe", "reg.exe", "certutil.exe", "bitsadmin.exe", "msbuild.exe", "esentutl.exe") or
+
+  ((process.Ext.relative_file_creation_time <= 900 or process.Ext.relative_file_name_modify_time <= 900) and
+   not process.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and
+   not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*"))
+ ) and
+ not (process.name : "rundll32.exe" and
+      process.command_line : ("*davclnt.dll,DavSetCookie*", "*?:\\Program Files*",
+                              "*\\Windows\\System32\\winethc.dll*", "*\\Windows\\SYSTEM32\\EDGEHTML.dll*",
+                              "*shell32.dll,SHCreateLocalServerRunDll*")) and
+ not startswith~(process.Ext.effective_parent.name, process.parent.name) and 
+ not (process.name : "powershell.exe" and process.parent.name : "wmiprvse.exe" and process.Ext.effective_parent.executable : "?:\\Windows\\System32\\wsmprovhost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\RuntimeBroker.exe" and process.parent.executable : "?:\\Windows\\System32\\sihost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\sethc.exe" and process.parent.executable : "?:\\Windows\\System32\\svchost.exe") and 
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\explorer.exe" and 
+      process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\twain_32\\*.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Token Impersonation/Theft
+** ID: T1134.001
+** Reference URL: https://attack.mitre.org/techniques/T1134/001/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc
new file mode 100644
index 0000000000..aa179409b3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-12-8-process-created-with-an-elevated-token]]
+=== Process Created with an Elevated Token
+
+Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://lengjibo.github.io/token/
+* https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is only compatible with Elastic Endpoint 8.4+ */
+
+process where host.os.type == "windows" and event.action == "start" and
+
+ /* CreateProcessWithToken and effective parent is a privileged MS native binary used as a target for token theft */
+ user.id : "S-1-5-18"  and
+
+ /* Token Theft target process usually running as service are located in one of the following paths */
+ process.Ext.effective_parent.executable :
+                ("?:\\Windows\\*.exe",
+                 "?:\\Program Files\\*.exe",
+                 "?:\\Program Files (x86)\\*.exe",
+                 "?:\\ProgramData\\*") and
+
+/* Ignores Utility Manager in Windows running in debug mode */
+ not (process.Ext.effective_parent.executable : "?:\\Windows\\System32\\Utilman.exe" and
+      process.parent.executable : "?:\\Windows\\System32\\Utilman.exe" and process.parent.args : "/debug") and
+
+/* Ignores Windows print spooler service with correlation to Access Intelligent Form */
+not (process.parent.executable : "?\\Windows\\System32\\spoolsv.exe" and
+     process.executable: "?:\\Program Files*\\Access\\Intelligent Form\\*\\LaunchCreate.exe") and 
+
+/* Ignores Windows error reporting executables */
+ not process.executable : ("?:\\Windows\\System32\\WerFault.exe",
+                           "?:\\Windows\\SysWOW64\\WerFault.exe",
+                           "?:\\Windows\\System32\\WerFaultSecure.exe",
+                           "?:\\Windows\\SysWOW64\\WerFaultSecure.exe",
+                           "?:\\windows\\system32\\WerMgr.exe",
+                           "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe")  and
+
+ /* Ignores Windows updates from TiWorker.exe that runs with elevated privileges */
+ not (process.parent.executable : "?:\\Windows\\WinSxS\\*\\TiWorker.exe" and
+      process.executable : ("?:\\Windows\\Microsoft.NET\\Framework*.exe",
+                            "?:\\Windows\\WinSxS\\*.exe",
+                            "?:\\Windows\\System32\\inetsrv\\iissetup.exe",
+                            "?:\\Windows\\SysWOW64\\inetsrv\\iissetup.exe",
+                            "?:\\Windows\\System32\\inetsrv\\aspnetca.exe",
+                            "?:\\Windows\\SysWOW64\\inetsrv\\aspnetca.exe",
+                            "?:\\Windows\\System32\\lodctr.exe",
+                            "?:\\Windows\\SysWOW64\\lodctr.exe",
+                            "?:\\Windows\\System32\\netcfg.exe",
+                            "?:\\Windows\\Microsoft.NET\\Framework*\\*\\ngen.exe",
+                            "?:\\Windows\\Microsoft.NET\\Framework*\\*\\aspnet_regiis.exe")) and
+
+
+/* Ignores additional parent executables that run with elevated privileges */
+ not process.parent.executable : 
+               ("?:\\Windows\\System32\\AtBroker.exe", 
+                "?:\\Windows\\system32\\svchost.exe", 
+                "?:\\Program Files (x86)\\*.exe", 
+                "?:\\Program Files\\*.exe", 
+                "?:\\Windows\\System32\\msiexec.exe",
+                "?:\\Windows\\System32\\DriverStore\\*") and
+
+/* Ignores Windows binaries with a trusted signature and specific signature name */
+ not (process.code_signature.trusted == true and
+      process.code_signature.subject_name : 
+                ("philandro Software GmbH", 
+                 "Freedom Scientific Inc.", 
+                 "TeamViewer Germany GmbH", 
+                 "Projector.is, Inc.", 
+                 "TeamViewer GmbH", 
+                 "Cisco WebEx LLC", 
+                 "Dell Inc"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Access Token Manipulation
+** ID: T1134
+** Reference URL: https://attack.mitre.org/techniques/T1134/
+* Sub-technique:
+** Name: Create Process with Token
+** ID: T1134.002
+** Reference URL: https://attack.mitre.org/techniques/T1134/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory.asciidoc
new file mode 100644
index 0000000000..0643456fa2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory.asciidoc
@@ -0,0 +1,196 @@
+[[prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory]]
+=== Process Execution from an Unusual Directory
+
+Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Process Execution from an Unusual Directory*
+
+
+This rule identifies processes that are executed from suspicious default Windows directories. Adversaries may abuse this technique by planting malware in trusted paths, making it difficult for security analysts to discern if their activities are malicious or take advantage of exceptions that may apply to these paths.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes, examining their executable files for prevalence, location, and valid digital signatures.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Examine arguments and working directory to determine the program's source or the nature of the tasks it is performing.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of executable and signature conditions.
+
+
+*Related Rules*
+
+
+- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5
+- Execution from Unusual Directory - Command Line - cff92c41-2225-4763-b4ce-6f71e5bda5e6
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  /* add suspicious execution paths here */
+  process.executable : (
+    "?:\\PerfLogs\\*.exe", "?:\\Users\\Public\\*.exe", "?:\\Windows\\Tasks\\*.exe",
+    "?:\\Intel\\*.exe", "?:\\AMD\\Temp\\*.exe", "?:\\Windows\\AppReadiness\\*.exe",
+    "?:\\Windows\\ServiceState\\*.exe", "?:\\Windows\\security\\*.exe", "?:\\Windows\\IdentityCRL\\*.exe",
+    "?:\\Windows\\Branding\\*.exe", "?:\\Windows\\csc\\*.exe", "?:\\Windows\\DigitalLocker\\*.exe",
+    "?:\\Windows\\en-US\\*.exe", "?:\\Windows\\wlansvc\\*.exe", "?:\\Windows\\Prefetch\\*.exe",
+    "?:\\Windows\\Fonts\\*.exe", "?:\\Windows\\diagnostics\\*.exe", "?:\\Windows\\TAPI\\*.exe",
+    "?:\\Windows\\INF\\*.exe", "?:\\Windows\\System32\\Speech\\*.exe", "?:\\windows\\tracing\\*.exe",
+    "?:\\windows\\IME\\*.exe", "?:\\Windows\\Performance\\*.exe", "?:\\windows\\intel\\*.exe",
+    "?:\\windows\\ms\\*.exe", "?:\\Windows\\dot3svc\\*.exe", "?:\\Windows\\panther\\*.exe",
+    "?:\\Windows\\RemotePackages\\*.exe", "?:\\Windows\\OCR\\*.exe", "?:\\Windows\\appcompat\\*.exe",
+    "?:\\Windows\\apppatch\\*.exe", "?:\\Windows\\addins\\*.exe", "?:\\Windows\\Setup\\*.exe",
+    "?:\\Windows\\Help\\*.exe", "?:\\Windows\\SKB\\*.exe", "?:\\Windows\\Vss\\*.exe",
+    "?:\\Windows\\Web\\*.exe", "?:\\Windows\\servicing\\*.exe", "?:\\Windows\\CbsTemp\\*.exe",
+    "?:\\Windows\\Logs\\*.exe", "?:\\Windows\\WaaS\\*.exe", "?:\\Windows\\ShellExperiences\\*.exe",
+    "?:\\Windows\\ShellComponents\\*.exe", "?:\\Windows\\PLA\\*.exe", "?:\\Windows\\Migration\\*.exe",
+    "?:\\Windows\\debug\\*.exe", "?:\\Windows\\Cursors\\*.exe", "?:\\Windows\\Containers\\*.exe",
+    "?:\\Windows\\Boot\\*.exe", "?:\\Windows\\bcastdvr\\*.exe", "?:\\Windows\\assembly\\*.exe",
+    "?:\\Windows\\TextInput\\*.exe", "?:\\Windows\\security\\*.exe", "?:\\Windows\\schemas\\*.exe",
+    "?:\\Windows\\SchCache\\*.exe", "?:\\Windows\\Resources\\*.exe", "?:\\Windows\\rescache\\*.exe",
+    "?:\\Windows\\Provisioning\\*.exe", "?:\\Windows\\PrintDialog\\*.exe", "?:\\Windows\\PolicyDefinitions\\*.exe",
+    "?:\\Windows\\media\\*.exe", "?:\\Windows\\Globalization\\*.exe", "?:\\Windows\\L2Schemas\\*.exe",
+    "?:\\Windows\\LiveKernelReports\\*.exe", "?:\\Windows\\ModemLogs\\*.exe",
+    "?:\\Windows\\ImmersiveControlPanel\\*.exe"
+  ) and
+  
+  not process.name : (
+    "SpeechUXWiz.exe", "SystemSettings.exe", "TrustedInstaller.exe",
+    "PrintDialog.exe", "MpSigStub.exe", "LMS.exe", "mpam-*.exe"
+  ) and
+  not process.executable :
+            ("?:\\Intel\\Wireless\\WUSetupLauncher.exe",
+             "?:\\Intel\\Wireless\\Setup.exe",
+             "?:\\Intel\\Move Mouse.exe",
+             "?:\\windows\\Panther\\DiagTrackRunner.exe",
+             "?:\\Windows\\servicing\\GC64\\tzupd.exe",
+             "?:\\Users\\Public\\res\\RemoteLite.exe",
+             "?:\\Users\\Public\\IBM\\ClientSolutions\\*.exe",
+             "?:\\Users\\Public\\Documents\\syspin.exe",
+             "?:\\Users\\Public\\res\\FileWatcher.exe")
+ /* uncomment once in winlogbeat */
+ /* and not (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) */
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-program-files-directory-masquerading.asciidoc
new file mode 100644
index 0000000000..87d54997af
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-program-files-directory-masquerading.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-12-8-program-files-directory-masquerading]]
+=== Program Files Directory Masquerading
+
+Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.executable : "C:\\*Program*Files*\\*.exe" and
+  not process.executable : (
+        "?:\\Program Files\\*.exe",
+        "?:\\Program Files (x86)\\*.exe",
+        "?:\\Users\\*.exe",
+        "?:\\ProgramData\\*.exe",
+        "?:\\Windows\\Downloaded Program Files\\*.exe",
+        "?:\\Windows\\Temp\\.opera\\????????????\\CProgram?FilesOpera*\\*.exe",
+        "?:\\Windows\\Temp\\.opera\\????????????\\CProgram?Files?(x86)Opera*\\*.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet.asciidoc
new file mode 100644
index 0000000000..10161bdacc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet.asciidoc
@@ -0,0 +1,100 @@
+[[prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet]]
+=== Rare SMB Connection to the Internet
+
+This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.securify.nl/en/blog/living-off-the-land-stealing-netntlm-hashes/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Exfiltration
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 3
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:network and host.os.type:windows and process.pid:4 and 
+  network.transport:tcp and destination.port:(139 or 445) and 
+  source.ip:(
+    10.0.0.0/8 or
+    172.16.0.0/12 or
+    192.168.0.0/16
+  ) and
+  not destination.ip:(
+    10.0.0.0/8 or
+    127.0.0.0/8 or
+    169.254.0.0/16 or
+    172.16.0.0/12 or
+    192.0.0.0/24 or
+    192.0.0.0/29 or
+    192.0.0.8/32 or
+    192.0.0.9/32 or
+    192.0.0.10/32 or
+    192.0.0.170/32 or
+    192.0.0.171/32 or
+    192.0.2.0/24 or
+    192.31.196.0/24 or
+    192.52.193.0/24 or
+    192.168.0.0/16 or
+    192.88.99.0/24 or
+    224.0.0.0/4 or
+    100.64.0.0/10 or
+    192.175.48.0/24 or
+    198.18.0.0/15 or
+    198.51.100.0/24 or
+    203.0.113.0/24 or
+    240.0.0.0/4 or
+    "::1" or
+    "FE80::/10" or
+    "FF00::/8"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Exfiltration
+** ID: TA0010
+** Reference URL: https://attack.mitre.org/tactics/TA0010/
+* Technique:
+** Name: Exfiltration Over Alternative Protocol
+** ID: T1048
+** Reference URL: https://attack.mitre.org/techniques/T1048/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rdp-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rdp-enabled-via-registry.asciidoc
new file mode 100644
index 0000000000..01dc7a5094
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-rdp-enabled-via-registry.asciidoc
@@ -0,0 +1,151 @@
+[[prebuilt-rule-8-12-8-rdp-enabled-via-registry]]
+=== RDP Enabled via Registry
+
+Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating RDP Enabled via Registry*
+
+
+Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
+
+Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.
+
+This rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the user to check if they are aware of the operation.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether it makes sense to enable RDP to this host, given its role in the environment.
+- Check if the host is directly exposed to the internet.
+- Check whether privileged accounts accessed the host shortly after the modification.
+- Review network events within a short timespan of this alert for incoming RDP connection attempts.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If RDP is needed, make sure to secure it using firewall rules:
+  - Allowlist RDP traffic to specific trusted hosts.
+  - Restrict RDP logins to authorized non-administrator accounts, where possible.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and 
+ event.type in ("creation", "change") and
+  registry.path : "HKLM\\SYSTEM\\*ControlSet*\\Control\\Terminal Server\\fDenyTSConnections" and
+  registry.data.strings : ("0", "0x00000000") and
+  not process.executable : ("?:\\Windows\\System32\\SystemPropertiesRemote.exe", 
+                            "?:\\Windows\\System32\\SystemPropertiesComputerName.exe", 
+                            "?:\\Windows\\System32\\SystemPropertiesAdvanced.exe", 
+                            "?:\\Windows\\System32\\SystemSettingsAdminFlows.exe", 
+                            "?:\\Windows\\WinSxS\\*\\TiWorker.exe", 
+                            "?:\\Windows\\system32\\svchost.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll.asciidoc
new file mode 100644
index 0000000000..22f4b4ca48
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll.asciidoc
@@ -0,0 +1,100 @@
+[[prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll]]
+=== Registry Persistence via AppCert DLL
+
+Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+/* uncomment once stable length(bytes_written_string) > 0 and */
+  registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Control\\Session Manager\\AppCertDLLs\\*"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: AppCert DLLs
+** ID: T1546.009
+** Reference URL: https://attack.mitre.org/techniques/T1546/009/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: AppCert DLLs
+** ID: T1546.009
+** Reference URL: https://attack.mitre.org/techniques/T1546/009/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll.asciidoc
new file mode 100644
index 0000000000..c1520154f3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll.asciidoc
@@ -0,0 +1,175 @@
+[[prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll]]
+=== Registry Persistence via AppInit DLL
+
+AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Registry Persistence via AppInit DLL*
+
+
+AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads `user32.dll`) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications.
+
+Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.
+
+This rule identifies modifications on the AppInit registry keys.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review the source process and related DLL file tied to the Windows Registry entry.
+  - Check whether the DLL is signed, and tied to a authorized program used on your environment.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Retrieve all DLLs under the AppInit registry keys:
+  - !{osquery{"label":"Osquery - Retrieve AppInit Registry Value","query":"SELECT * FROM registry r where (r.key == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows' or\nr.key == 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows') and r.name ==\n'AppInit_DLLs'\n"}}
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable and the DLLs using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+  registry.path : (
+     "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+     "HKLM\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+     "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
+     "\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls"
+  ) and
+  not process.executable : (
+     "?:\\Windows\\System32\\DriverStore\\FileRepository\\*\\Display.NvContainer\\NVDisplay.Container.exe",
+     "?:\\Windows\\System32\\msiexec.exe",
+     "?:\\Windows\\SysWOW64\\msiexec.exe",
+     "?:\\Program Files\\Commvault\\Base\\cvd.exe",
+     "?:\\Program Files\\Commvault\\ContentStore*\\Base\\cvd.exe",
+     "?:\\Program Files (x86)\\Commvault\\Base\\cvd.exe",
+     "?:\\Program Files (x86)\\Commvault\\ContentStore*\\Base\\cvd.exe",
+     "?:\\Program Files\\NVIDIA Corporation\\Display.NvContainer\\NVDisplay.Container.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: AppInit DLLs
+** ID: T1546.010
+** Reference URL: https://attack.mitre.org/techniques/T1546/010/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
new file mode 100644
index 0000000000..c483154de6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh]]
+=== Remote Desktop Enabled in Windows Firewall by Netsh
+
+Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote Desktop Enabled in Windows Firewall by Netsh*
+
+
+Microsoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.
+
+Attackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.
+
+This rule detects the creation of a Windows Firewall inbound rule that would allow inbound RDP traffic using the `netsh.exe` utility.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the user to check if they are aware of the operation.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether it makes sense to enable RDP to this host, given its role in the environment.
+- Check if the host is directly exposed to the internet.
+- Check whether privileged accounts accessed the host shortly after the modification.
+- Review network events within a short timespan of this alert for incoming RDP connection attempts.
+
+
+*False positive analysis*
+
+
+- The `netsh.exe` utility can be used legitimately. Check whether the user should be performing this kind of activity, whether the user is aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- If RDP is needed, make sure to secure it:
+  - Allowlist RDP traffic to specific trusted hosts.
+  - Restrict RDP logins to authorized non-administrator accounts, where possible.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "netsh.exe" or ?process.pe.original_file_name == "netsh.exe") and
+ process.args : ("localport=3389", "RemoteDesktop", "group=\"remote desktop\"") and
+ process.args : ("action=allow", "enable=Yes", "enable")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share.asciidoc
new file mode 100644
index 0000000000..8c605f5870
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share.asciidoc
@@ -0,0 +1,87 @@
+[[prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share]]
+=== Remote File Copy to a Hidden Share
+
+Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+    process.name : ("cmd.exe", "powershell.exe", "xcopy.exe") and
+    process.args : ("copy*", "move*", "cp", "mv") or
+    process.name : "robocopy.exe"
+  ) and process.args : "*\\\\*\\*$*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer.asciidoc
new file mode 100644
index 0000000000..eda9303370
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer]]
+=== Remote File Copy via TeamViewer
+
+Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote File Copy via TeamViewer*
+
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.
+
+TeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Contact the user to gather information about who and why was conducting the remote access.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this access.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and process.name : "TeamViewer.exe" and
+  file.extension : ("exe", "dll", "scr", "com", "bat", "ps1", "vbs", "vbe", "js", "wsh", "hta") and
+  not 
+  (
+    file.path : (
+      "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\*.js",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\TeamViewer\\update.exe",
+      "?:\\Users\\*\\AppData\\Local\\Temp\\?\\TeamViewer\\update.exe"
+    ) and process.code_signature.trusted == true
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility.asciidoc
new file mode 100644
index 0000000000..637cc7e184
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -0,0 +1,155 @@
+[[prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility]]
+=== Remote File Download via Desktopimgdownldr Utility
+
+Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via Desktopimgdownldr Utility*
+
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
+
+The `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file from an internal system.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.
+- Analysts can dismiss the alert if the downloaded file is a legitimate image.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "desktopimgdownldr.exe" or ?process.pe.original_file_name == "desktopimgdownldr.exe") and
+  process.args : "/lockscreenurl:http*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun.asciidoc
new file mode 100644
index 0000000000..8f5b35e5b9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun]]
+=== Remote File Download via MpCmdRun
+
+Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/mohammadaskar2/status/1301263551638761477
+* https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remote File Download via MpCmdRun*
+
+
+Attackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.
+
+The `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/interactive-investigation-guides.html[Investigate Markdown Plugin] introduced in Elastic Stack version 8.8.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+  - !{investigate{"label":"Alerts associated with the user in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"user.id","queryType":"phrase","value":"{{user.id}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+  - !{investigate{"label":"Alerts associated with the host in the last 48h","providers":[[{"excluded":false,"field":"event.kind","queryType":"phrase","value":"signal","valueType":"string"},{"excluded":false,"field":"host.name","queryType":"phrase","value":"{{host.name}}","valueType":"string"}]],"relativeFrom":"now-48h/h","relativeTo":"now"}}
+- Check the reputation of the domain or IP address used to host the downloaded file.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+        - !{investigate{"label":"Investigate the Subject Process Network Events","providers":[[{"excluded":false,"field":"process.entity_id","queryType":"phrase","value":"{{process.entity_id}}","valueType":"string"},{"excluded":false,"field":"event.category","queryType":"phrase","value":"network","valueType":"string"}]]}}
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "MpCmdRun.exe" or ?process.pe.original_file_name == "MpCmdRun.exe") and
+   process.args : "-DownloadFile" and process.args : "-url" and process.args : "-path"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remotely-started-services-via-rpc.asciidoc
new file mode 100644
index 0000000000..5a581ef7e9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-remotely-started-services-via-rpc.asciidoc
@@ -0,0 +1,169 @@
+[[prebuilt-rule-8-12-8-remotely-started-services-via-rpc]]
+=== Remotely Started Services via RPC
+
+Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/705b624a-13de-43cc-b8a2-99573da3635f
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Remotely Started Services via RPC*
+
+
+The Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service programs running on a remote computer. A remote service management session begins with the client initiating the connection request to the server. If the server grants the request, the connection is established. The client can then make multiple requests to modify, query the configuration, or start and stop services on the server by using the same session until the session is terminated.
+
+This rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the `source.address` field to help identify the source system.
+- Review network events from the source system using the source port identified on the alert and try to identify the program used to initiate the action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- Remote management software like SCCM may trigger this rule. If noisy on your environment, consider adding exceptions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1s
+   [network where host.os.type == "windows" and process.name : "services.exe" and
+      network.direction : ("incoming", "ingress") and network.transport == "tcp" and
+      source.port >= 49152 and destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1"
+   ] by host.id, process.entity_id
+   [process where host.os.type == "windows" and 
+       event.type == "start" and process.parent.name : "services.exe" and
+       not (process.executable : "?:\\Windows\\System32\\msiexec.exe" and process.args : "/V") and
+       not process.executable : (
+                "?:\\Pella Corporation\\OSCToGPAutoService\\OSCToGPAutoSvc.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Pella Corporation\\Pella Order Management\\GPAutoSvc.exe",
+                "?:\\Program Files (x86)\\*.exe",
+                "?:\\Program Files\\*.exe",
+                "?:\\Windows\\ADCR_Agent\\adcrsvc.exe",
+                "?:\\Windows\\AdminArsenal\\PDQ*.exe",
+                "?:\\Windows\\CAInvokerService.exe",
+                "?:\\Windows\\ccmsetup\\ccmsetup.exe",
+                "?:\\Windows\\eset-remote-install-service.exe",
+                "?:\\Windows\\ProPatches\\Scheduler\\STSchedEx.exe",
+                "?:\\Windows\\PSEXESVC.EXE",
+                "?:\\Windows\\RemoteAuditService.exe",
+                "?:\\Windows\\servicing\\TrustedInstaller.exe",
+                "?:\\Windows\\System32\\certsrv.exe",
+                "?:\\Windows\\System32\\sppsvc.exe",
+                "?:\\Windows\\System32\\srmhost.exe",
+                "?:\\Windows\\System32\\svchost.exe",
+                "?:\\Windows\\System32\\taskhostex.exe",
+                "?:\\Windows\\System32\\upfc.exe",
+                "?:\\Windows\\System32\\vds.exe",
+                "?:\\Windows\\System32\\VSSVC.exe",
+                "?:\\Windows\\System32\\wbem\\WmiApSrv.exe",
+                "?:\\Windows\\SysWOW64\\NwxExeSvc\\NwxExeSvc.exe",
+                "?:\\Windows\\Veeam\\Backup\\VeeamDeploymentSvc.exe",
+                "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
+                "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe"
+       )] by host.id, process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter.asciidoc
new file mode 100644
index 0000000000..e0c1e13f65
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter.asciidoc
@@ -0,0 +1,148 @@
+[[prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter]]
+=== Renamed AutoIt Scripts Interpreter
+
+Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Renamed AutoIt Scripts Interpreter*
+
+
+The OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.
+
+AutoIt is a scripting language and tool for automating tasks on Microsoft Windows operating systems. Due to its capabilities, malicious threat actors can abuse it to create malicious scripts and distribute malware.
+
+This rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name.asciidoc
new file mode 100644
index 0000000000..9bc8658c63
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name.asciidoc
@@ -0,0 +1,132 @@
+[[prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name]]
+=== Renamed Utility Executed with Short Program Name
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Renamed Utility Executed with Short Program Name*
+
+
+Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and length(process.name) > 0 and
+ length(process.name) == 5 and length(process.pe.original_file_name) > 5
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled.asciidoc
new file mode 100644
index 0000000000..5225fafaa5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled.asciidoc
@@ -0,0 +1,101 @@
+[[prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled]]
+=== Scheduled Tasks AT Command Enabled
+
+Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+  registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Configuration\\EnableAt"
+  ) and registry.data.strings : ("1", "0x00000001")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: At
+** ID: T1053.002
+** Reference URL: https://attack.mitre.org/techniques/T1053/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..3499e95dde
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,87 @@
+[[prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes]]
+=== ScreenConnect Server Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* logs-system.security*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "ScreenConnect.Service.exe" and
+  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "csc.exe") or
+  ?process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd.asciidoc
new file mode 100644
index 0000000000..db64fc5a87
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd]]
+=== Searching for Saved Credentials via VaultCmd
+
+Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
+* https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (?process.pe.original_file_name:"vaultcmd.exe" or process.name:"vaultcmd.exe") and
+  process.args:"/list*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Sub-technique:
+** Name: Windows Credential Manager
+** ID: T1555.004
+** Reference URL: https://attack.mitre.org/techniques/T1555/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter.asciidoc
new file mode 100644
index 0000000000..c55a8d1c8b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter.asciidoc
@@ -0,0 +1,172 @@
+[[prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter]]
+=== Service Control Spawned via Script Interpreter
+
+Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* logs-system.*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Service Control Spawned via Script Interpreter*
+
+
+Windows services are background processes that run with SYSTEM privileges and provide specific functionality or support to other applications and system components.
+
+The `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the command line, registry changes events, and Windows events related to service activities (for example, 4697 and/or 7045) for suspicious characteristics.
+  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
+    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This activity is not inherently malicious if it occurs in isolation. As long as the analyst did not identify suspicious activity related to the user, host, and service, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the service or restore it to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+/* This rule is not compatible with Sysmon due to user.id issues */
+
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "sc.exe" or process.pe.original_file_name == "sc.exe") and
+  process.parent.name : ("cmd.exe", "wscript.exe", "rundll32.exe", "regsvr32.exe",
+                         "wmic.exe", "mshta.exe","powershell.exe", "pwsh.exe") and
+  process.args:("config", "create", "start", "delete", "stop", "pause") and
+  /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Regsvr32
+** ID: T1218.010
+** Reference URL: https://attack.mitre.org/techniques/T1218/010/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sip-provider-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sip-provider-modification.asciidoc
new file mode 100644
index 0000000000..e0fde23023
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sip-provider-modification.asciidoc
@@ -0,0 +1,76 @@
+[[prebuilt-rule-8-12-8-sip-provider-modification]]
+=== SIP Provider Modification
+
+Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/mattifestation/PoCSubjectInterfacePackage
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type:"change" and
+  registry.path: (
+    "*\\SOFTWARE\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll",
+    "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllPutSignedDataMsg\\{*}\\Dll",
+    "*\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll",
+    "*\\SOFTWARE\\WOW6432Node\\Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{*}\\$Dll"
+    ) and
+  registry.data.strings:"*.dll"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Subvert Trust Controls
+** ID: T1553
+** Reference URL: https://attack.mitre.org/techniques/T1553/
+* Sub-technique:
+** Name: SIP and Trust Provider Hijacking
+** ID: T1553.003
+** Reference URL: https://attack.mitre.org/techniques/T1553/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry.asciidoc
new file mode 100644
index 0000000000..0629a00c18
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry]]
+=== SolarWinds Process Disabling Services via Registry
+
+Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\Start",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\Start"
+  ) and
+  registry.data.strings : ("4", "0x00000004") and
+  process.name : (
+      "SolarWinds.BusinessLayerHost*.exe",
+      "ConfigurationWizard*.exe",
+      "NetflowDatabaseMaintenance*.exe",
+      "NetFlowService*.exe",
+      "SolarWinds.Administration*.exe",
+      "SolarWinds.Collector.Service*.exe",
+      "SolarwindsDiagnostics*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Supply Chain Compromise
+** ID: T1195
+** Reference URL: https://attack.mitre.org/techniques/T1195/
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-or-run-key-registry-modification.asciidoc
new file mode 100644
index 0000000000..4ba112723c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-or-run-key-registry-modification.asciidoc
@@ -0,0 +1,324 @@
+[[prebuilt-rule-8-12-8-startup-or-run-key-registry-modification]]
+=== Startup or Run Key Registry Modification
+
+Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Startup or Run Key Registry Modification*
+
+
+Adversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.
+
+
+*Related rules*
+
+
+- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
+- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
+- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f
+- Startup Persistence by a Suspicious Process - 440e2db4-bc7f-4c96-a068-65b78da59bde
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.data.strings != null and
+ registry.path : (
+     /* Machine Hive */
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+     "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*",
+     /* Users Hive */
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell\\*"
+     ) and
+  /* add common legitimate changes without being too restrictive as this is one of the most abused AESPs */
+  not registry.data.strings : "ctfmon.exe /n" and
+  not (registry.value : "Application Restart #*" and process.name : "csrss.exe") and
+  not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
+  not registry.data.strings : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
+  not process.executable : ("?:\\Windows\\System32\\msiexec.exe", "?:\\Windows\\SysWOW64\\msiexec.exe") and
+  not (
+    /* Logitech G Hub */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Logitech Inc" and
+      (
+        process.name : "lghub_agent.exe" and registry.data.strings : (
+          "\"?:\\Program Files\\LGHUB\\lghub.exe\" --background",
+          "\"?:\\Program Files\\LGHUB\\system_tray\\lghub_system_tray.exe\" --minimized"
+        )
+      ) or
+      (
+        process.name : "LogiBolt.exe" and registry.data.strings : (
+          "?:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe --startup",
+          "?:\\Users\\*\\AppData\\Local\\Logi\\LogiBolt\\LogiBolt.exe --startup"
+        )
+      )
+    ) or
+
+    /* Google Drive File Stream, Chrome, and Google Update */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Google LLC" and
+      (
+        process.name : "GoogleDriveFS.exe" and registry.data.strings : (
+        "\"?:\\Program Files\\Google\\Drive File Stream\\*\\GoogleDriveFS.exe\" --startup_mode"
+        ) or
+
+        process.name : "chrome.exe" and registry.data.strings : (
+          "\"?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5",
+          "\"?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5"
+        ) or
+
+        process.name : "GoogleUpdate.exe" and registry.data.strings : (
+          "\"?:\\Users\\*\\AppData\\Local\\Google\\Update\\*\\GoogleUpdateCore.exe\""
+        )
+      )
+    ) or
+
+    /* MS Programs */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") and
+      (
+        process.name : "msedge.exe" and registry.data.strings : (
+          "\"?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start /prefetch:5",
+          "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --win-session-start",
+          "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start"
+        ) or
+
+        process.name : ("Update.exe", "Teams.exe") and registry.data.strings : (
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\"",
+          "?:\\ProgramData\\*\\Microsoft\\Teams\\Update.exe --processStart \"Teams.exe\" --process-start-args \"--system-initiated\""
+        ) or
+
+        process.name : "OneDriveStandaloneUpdater.exe" and registry.data.strings : (
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\\Microsoft.SharePoint.exe"
+        ) or
+
+        process.name : "OneDriveSetup.exe" and
+          registry.data.strings : (
+            "?:\\Windows\\system32\\cmd.exe /q /c * \"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\*\"",
+            "?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe /background*",
+            "\"?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe\" /background*",
+            "?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe /background *",
+            "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\??.???.????.????\\Microsoft.SharePoint.exe"
+          ) or
+        
+        process.name : "OneDrive.exe" and registry.data.strings : (
+          "\"?:\\Program Files\\Microsoft OneDrive\\OneDrive.exe\" /background",
+          "\"?:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe\" /background",
+          "\"?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background"
+        ) or
+        
+        process.name : "Microsoft.SharePoint.exe" and registry.data.strings : (
+          "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\??.???.????.????\\Microsoft.SharePoint.exe"
+        ) or
+        
+        process.name : "MicrosoftEdgeUpdate.exe" and registry.data.strings : (
+          "\"?:\\Users\\Expedient\\AppData\\Local\\Microsoft\\EdgeUpdate\\*\\MicrosoftEdgeUpdateCore.exe\""
+        ) or
+        
+        process.executable : "?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\Installer\\setup.exe" and
+        registry.data.strings : (
+          "\"?:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\*\\Installer\\setup.exe\" --msedgewebview --delete-old-versions --system-level --verbose-logging --on-logon"
+        )
+      )
+    ) or
+
+    /* Slack */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name in (
+       "Slack Technologies, Inc.", "Slack Technologies, LLC"
+      ) and process.name : "slack.exe" and registry.data.strings : (
+        "\"?:\\Users\\*\\AppData\\Local\\slack\\slack.exe\" --process-start-args --startup",
+        "\"?:\\ProgramData\\*\\slack\\slack.exe\" --process-start-args --startup",
+        "\"?:\\Program Files\\Slack\\slack.exe\" --process-start-args --startup"
+      )
+    ) or
+
+    /* Cisco */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name in ("Cisco WebEx LLC", "Cisco Systems, Inc.") and
+      (
+        process.name : "WebexHost.exe" and registry.data.strings : (
+          "\"?:\\Users\\*\\AppData\\Local\\WebEx\\WebexHost.exe\" /daemon /runFrom=autorun"
+        )
+      ) or
+      (
+        process.name : "CiscoJabber.exe" and registry.data.strings : (
+          "\"?:\\Program Files (x86)\\Cisco Systems\\Cisco Jabber\\CiscoJabber.exe\" /min"
+        )
+      )
+    ) or
+
+    /* Loom */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Loom, Inc." and
+      process.name : "Loom.exe" and registry.data.strings : (
+        "?:\\Users\\*\\AppData\\Local\\Programs\\Loom\\Loom.exe --process-start-args \"--loomHidden\""
+      )
+    ) or
+
+    /* Adobe */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Adobe Inc." and
+      process.name : ("Acrobat.exe", "FlashUtil32_*_Plugin.exe") and registry.data.strings : (
+        "\"?:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe\"",
+        "\"?:\\Program Files (x86)\\Adobe\\Acrobat DC\\Acrobat\\AdobeCollabSync.exe\"",
+        "?:\\WINDOWS\\SysWOW64\\Macromed\\Flash\\FlashUtil32_*_Plugin.exe -update plugin"
+      )
+    ) or
+
+    /* CCleaner */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "PIRIFORM SOFTWARE LIMITED" and
+      process.name : ("CCleanerBrowser.exe", "CCleaner64.exe") and registry.data.strings : (
+        "\"C:\\Program Files (x86)\\CCleaner Browser\\Application\\CCleanerBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"",
+        "\"C:\\Program Files\\CCleaner\\CCleaner64.exe\" /MONITOR"
+      )
+    ) or
+
+    /* Opera */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Opera Norway AS" and
+      process.name : "opera.exe" and registry.data.strings : (
+        "?:\\Users\\*\\AppData\\Local\\Programs\\Opera\\launcher.exe",
+        "?:\\Users\\*\\AppData\\Local\\Programs\\Opera GX\\launcher.exe"
+      )
+    ) or
+
+    /* Avast */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Avast Software s.r.o." and
+      process.name : "AvastBrowser.exe" and registry.data.strings : (
+        "\"?:\\Users\\*\\AppData\\Local\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup*",
+        "\"?:\\Program Files (x86)\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup*",
+        ""
+      )
+    ) or
+
+    /* Grammarly */
+    (
+      process.code_signature.trusted == true and process.code_signature.subject_name == "Grammarly, Inc." and
+      process.name : "GrammarlyInstaller.exe" and registry.data.strings : (
+        "?:\\Users\\*\\AppData\\Local\\Grammarly\\DesktopIntegrations\\Grammarly.Desktop.exe"
+      )
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process.asciidoc
new file mode 100644
index 0000000000..0a82578bb9
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process.asciidoc
@@ -0,0 +1,178 @@
+[[prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process]]
+=== Startup Persistence by a Suspicious Process
+
+Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Startup Persistence by a Suspicious Process*
+
+
+The Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.
+
+This rule monitors for commonly abused processes writing to the Startup folder locations.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- Administrators may add programs to this mechanism via command-line shells. Before the further investigation, verify that this activity is not benign.
+
+
+*Related rules*
+
+
+- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff
+- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  user.domain != "NT AUTHORITY" and
+  file.path : ("C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
+               "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*") and
+  process.name : ("cmd.exe",
+                  "powershell.exe",
+                  "wmic.exe",
+                  "mshta.exe",
+                  "pwsh.exe",
+                  "cscript.exe",
+                  "wscript.exe",
+                  "regsvr32.exe",
+                  "RegAsm.exe",
+                  "rundll32.exe",
+                  "EQNEDT32.EXE",
+                  "WINWORD.EXE",
+                  "EXCEL.EXE",
+                  "POWERPNT.EXE",
+                  "MSPUB.EXE",
+                  "MSACCESS.EXE",
+                  "iexplore.exe",
+                  "InstallUtil.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sunburst-command-and-control-activity.asciidoc
new file mode 100644
index 0000000000..fd689f4507
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-sunburst-command-and-control-activity.asciidoc
@@ -0,0 +1,157 @@
+[[prebuilt-rule-8-12-8-sunburst-command-and-control-activity]]
+=== SUNBURST Command and Control Activity
+
+The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.network-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating SUNBURST Command and Control Activity*
+
+
+SUNBURST is a trojanized version of a digitally signed SolarWinds Orion plugin called SolarWinds.Orion.Core.BusinessLayer.dll. The plugin contains a backdoor that communicates via HTTP to third-party servers. After an initial dormant period of up to two weeks, SUNBURST may retrieve and execute commands that instruct the backdoor to transfer files, execute files, profile the system, reboot the system, and disable system services. The malware's network traffic attempts to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol, and the malware stores persistent state data within legitimate plugin configuration files. The backdoor uses multiple obfuscated blocklists to identify processes, services, and drivers associated with forensic and anti-virus tools.
+
+More details on SUNBURST can be found on the https://www.mandiant.com/resources/sunburst-additional-technical-details[Mandiant Report].
+
+This rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the executable involved using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the environment at risk.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Upgrade SolarWinds systems to the latest version to eradicate the chance of reinfection by abusing the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+network where host.os.type == "windows" and event.type == "protocol" and network.protocol == "http" and
+  process.name : ("ConfigurationWizard.exe",
+                  "NetFlowService.exe",
+                  "NetflowDatabaseMaintenance.exe",
+                  "SolarWinds.Administration.exe",
+                  "SolarWinds.BusinessLayerHost.exe",
+                  "SolarWinds.BusinessLayerHostx64.exe",
+                  "SolarWinds.Collector.Service.exe",
+                  "SolarwindsDiagnostics.exe") and
+  (
+    (
+      (http.request.body.content : "*/swip/Upload.ashx*" and http.request.body.content : ("POST*", "PUT*")) or
+      (http.request.body.content : ("*/swip/SystemDescription*", "*/swip/Events*") and http.request.body.content : ("GET*", "HEAD*"))
+    ) and
+    not http.request.body.content : "*solarwinds.com*"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Application Layer Protocol
+** ID: T1071
+** Reference URL: https://attack.mitre.org/techniques/T1071/
+* Sub-technique:
+** Name: Web Protocols
+** ID: T1071.001
+** Reference URL: https://attack.mitre.org/techniques/T1071/001/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Supply Chain Compromise
+** ID: T1195
+** Reference URL: https://attack.mitre.org/techniques/T1195/
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes.asciidoc
new file mode 100644
index 0000000000..2348e828b5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes]]
+=== Suspicious Access to LDAP Attributes
+
+Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.security*
+* logs-windows.forwarded*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: System
+* Data Source: Active Directory
+* Data Source: Windows
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where event.action == "Directory Service Access" and
+ event.code == "4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and
+ winlog.event_data.AccessMaskDescription == "Read Property" and length(winlog.event_data.Properties) >= 2000
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll.asciidoc
new file mode 100644
index 0000000000..bd86289b01
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll.asciidoc
@@ -0,0 +1,142 @@
+[[prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll]]
+=== Suspicious Antimalware Scan Interface DLL
+
+Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 9
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Antimalware Scan Interface DLL*
+
+
+The Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.
+
+Attackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Identify the process that created the DLL and which account was used.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate the execution of scripts and macros after the registry modification.
+- Investigate other processes launched from the directory that the DLL was created.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and file.path != null and
+ file.name : ("amsi.dll", "amsi") and not file.path : ("?:\\Windows\\system32\\amsi.dll", "?:\\Windows\\Syswow64\\amsi.dll", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\WinSXS\\*", "?:\\$WINDOWS.~BT\\NewOS\\Windows\\servicing\\LCU\\*", "?:\\$WINDOWS.~BT\\Work\\*\\*", "?:\\Windows\\SoftwareDistribution\\Download\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Search Order Hijacking
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-certutil-commands.asciidoc
new file mode 100644
index 0000000000..44b31a614f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-certutil-commands.asciidoc
@@ -0,0 +1,137 @@
+[[prebuilt-rule-8-12-8-suspicious-certutil-commands]]
+=== Suspicious CertUtil Commands
+
+Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/Moriarty_Meng/status/984380793383370752
+* https://twitter.com/egre55/status/1087685529016193025
+* https://www.sysadmins.lv/blog-en/certutil-tips-and-tricks-working-with-x509-file-format.aspx
+* https://docs.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious CertUtil Commands*
+
+
+`certutil.exe` is a command line utility program that is included with Microsoft Windows operating systems. It is used to manage and manipulate digital certificates and certificate services on computers running Windows.
+
+Attackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Examine the command line to determine the nature of the execution.
+  - If files were downloaded, retrieve them and check whether they were run, and under which security context.
+  - If files were obfuscated or deobfuscated, retrieve them.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the involved files using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- If this rule is noisy in your environment due to expected activity, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "certutil.exe" or ?process.pe.original_file_name == "CertUtil.exe") and
+  process.args : ("?decode", "?encode", "?urlcache", "?verifyctl", "?encodehex", "?decodehex", "?exportPFX")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Deobfuscate/Decode Files or Information
+** ID: T1140
+** Reference URL: https://attack.mitre.org/techniques/T1140/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi.asciidoc
new file mode 100644
index 0000000000..60df6802b8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi.asciidoc
@@ -0,0 +1,88 @@
+[[prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi]]
+=== Suspicious Cmd Execution via WMI
+
+Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "WmiPrvSE.exe" and process.name : "cmd.exe" and
+ process.args : "\\\\127.0.0.1\\*" and process.args : ("2>&1", "1>")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
new file mode 100644
index 0000000000..c28e1457ed
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -0,0 +1,191 @@
+[[prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation]]
+=== Suspicious DLL Loaded for Persistence or Privilege Escalation
+
+Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.library*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://itm4n.github.io/windows-dll-hijacking-clarified/
+* http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
+* https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
+* https://shellz.club/2020/10/16/edgegdi-dll-for-persistence-and-lateral-movement.html
+* https://windows-internals.com/faxing-your-way-to-system/
+* http://waleedassar.blogspot.com/2013/01/wow64logdll.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation*
+
+
+Attackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.
+
+
+*Possible investigation steps*
+
+
+- Examine the DLL signature and identify the process that created it.
+  - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve the DLL and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("driver", "library") or (event.category == "process" and event.action : "Image loaded*")) and
+ (
+  /* compatible with Elastic Endpoint Library Events */
+  (?dll.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+               "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+               "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "oci.dll", "TPPCOIPW32.dll", 
+               "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll")
+   and (?dll.code_signature.trusted != true or ?dll.code_signature.exists != true)) or
+
+  /* compatible with Sysmon EventID 7 - Image Load */
+  (file.name : ("wlbsctrl.dll", "wbemcomn.dll", "WptsExtensions.dll", "Tsmsisrv.dll", "TSVIPSrv.dll", "Msfte.dll",
+               "wow64log.dll", "WindowsCoreDeviceInfo.dll", "Ualapi.dll", "wlanhlp.dll", "phoneinfo.dll", "EdgeGdi.dll",
+               "cdpsgshims.dll", "windowsperformancerecordercontrol.dll", "diagtrack_win.dll", "oci.dll", "TPPCOIPW32.dll", 
+               "tpgenlic.dll", "thinmon.dll", "fxsst.dll", "msTracer.dll") and 
+   not file.path : ("?:\\Windows\\System32\\wbemcomn.dll", "?:\\Windows\\SysWOW64\\wbemcomn.dll") and 
+   not file.hash.sha256 : 
+            ("6e837794fc282446906c36d681958f2f6212043fc117c716936920be166a700f", 
+             "b14e4954e8cca060ffeb57f2458b6a3a39c7d2f27e94391cbcea5387652f21a4", 
+             "c258d90acd006fa109dc6b748008edbb196d6168bc75ace0de0de54a4db46662") and 
+   not file.code_signature.status == "Valid")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Search Order Hijacking
+** ID: T1574.001
+** Reference URL: https://attack.mitre.org/techniques/T1574/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process.asciidoc
new file mode 100644
index 0000000000..a434b7f5cb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process.asciidoc
@@ -0,0 +1,107 @@
+[[prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process]]
+=== Suspicious Endpoint Security Parent Process
+
+A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("esensor.exe", "elastic-endpoint.exe") and
+  process.parent.executable != null and
+  /* add FPs here */
+  not process.parent.executable : (
+        "?:\\Program Files\\Elastic\\*",
+        "?:\\Windows\\System32\\services.exe",
+        "?:\\Windows\\System32\\WerFault*.exe",
+        "?:\\Windows\\System32\\wermgr.exe",
+        "?:\\Windows\\explorer.exe"
+  ) and
+  not (
+    process.parent.executable : (
+        "?:\\Windows\\System32\\cmd.exe",
+        "?:\\Windows\\System32\\SecurityHealthHost.exe",
+        "?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+    ) and
+    process.args : (
+        "test", "version",
+        "top", "run",
+        "*help", "status",
+        "upgrade", "/launch",
+        "/enable"
+    )
+  )
+  
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device.asciidoc
new file mode 100644
index 0000000000..b1db798479
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device]]
+=== Suspicious Execution from a Mounted Device
+
+Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
+* https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.executable : "C:\\*" and
+  (process.working_directory : "?:\\" and not process.working_directory: "C:\\") and
+  process.parent.name : "explorer.exe" and
+  process.name : ("rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "regsvr32.exe",
+                  "cscript.exe", "wscript.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Mshta
+** ID: T1218.005
+** Reference URL: https://attack.mitre.org/techniques/T1218/005/
+* Sub-technique:
+** Name: Regsvr32
+** ID: T1218.010
+** Reference URL: https://attack.mitre.org/techniques/T1218/010/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache.asciidoc
new file mode 100644
index 0000000000..366ac0a301
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache.asciidoc
@@ -0,0 +1,82 @@
+[[prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache]]
+=== Suspicious Execution from INET Cache
+
+Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Command and Control
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and  
+ process.parent.name : ("explorer.exe", "winrar.exe", "7zFM.exe", "Bandizip.exe") and
+  (process.args : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*" or
+   process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\Windows\\INetCache\\IE\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Ingress Tool Transfer
+** ID: T1105
+** Reference URL: https://attack.mitre.org/techniques/T1105/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins.asciidoc
new file mode 100644
index 0000000000..6d94e04c57
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins.asciidoc
@@ -0,0 +1,123 @@
+[[prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins]]
+=== Suspicious Execution via Microsoft Office Add-Ins
+
+Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/Octoberfest7/XLL_Phishing
+* https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Persistence
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 5
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where 
+    
+    host.os.type == "windows" and event.type == "start" and  
+    
+    process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSACCESS.EXE", "VSTOInstaller.exe") and 
+    
+    process.args regex~ """.+\.(wll|xll|ppa|ppam|xla|xlam|vsto)""" and 
+    
+    /* Office Add-In from suspicious paths */
+    (process.args :
+             ("?:\\Users\\*\\Temp\\7z*",
+              "?:\\Users\\*\\Temp\\Rar$*",
+              "?:\\Users\\*\\Temp\\Temp?_*",
+              "?:\\Users\\*\\Temp\\BNZ.*",
+              "?:\\Users\\*\\Downloads\\*",
+              "?:\\Users\\*\\AppData\\Roaming\\*",
+              "?:\\Users\\Public\\*",
+              "?:\\ProgramData\\*",
+              "?:\\Windows\\Temp\\*",
+              "\\Device\\*",
+              "http*") or
+	      
+    process.parent.name : ("explorer.exe", "OpenWith.exe") or 
+    
+    /* Office Add-In from suspicious parent */
+    process.parent.name : ("cmd.exe", "powershell.exe")) and
+	  
+    /* False Positives */
+    not (process.args : "*.vsto" and
+         process.parent.executable :
+                   ("?:\\Program Files\\Logitech\\LogiOptions\\PlugInInstallerUtility*.exe",
+                    "?:\\ProgramData\\Logishrd\\LogiOptions\\Plugins\\VSTO\\*\\VSTOInstaller.exe",
+                    "?:\\Program Files\\Logitech\\LogiOptions\\PlugInInstallerUtility.exe",
+                    "?:\\Program Files\\LogiOptionsPlus\\PlugInInstallerUtility*.exe",
+                    "?:\\ProgramData\\Logishrd\\LogiOptionsPlus\\Plugins\\VSTO\\*\\VSTOInstaller.exe",
+                    "?:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*\\VSTOInstaller.exe")) and
+    not (process.args : "/Uninstall" and process.name : "VSTOInstaller.exe") and
+    not (process.parent.name : "rundll32.exe" and
+         process.parent.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and
+    not (process.name : "VSTOInstaller.exe" and process.args : "https://dl.getsidekick.com/outlook/vsto/Sidekick.vsto")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Office Application Startup
+** ID: T1137
+** Reference URL: https://attack.mitre.org/techniques/T1137/
+* Sub-technique:
+** Name: Add-ins
+** ID: T1137.006
+** Reference URL: https://attack.mitre.org/techniques/T1137/006/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task.asciidoc
new file mode 100644
index 0000000000..1929aa95ac
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task.asciidoc
@@ -0,0 +1,129 @@
+[[prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task]]
+=== Suspicious Execution via Scheduled Task
+
+Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+    /* Schedule service cmdline on Win10+ */
+    process.parent.name : "svchost.exe" and process.parent.args : "Schedule" and
+    /* add suspicious programs here */
+    process.pe.original_file_name in
+                                (
+                                  "cscript.exe",
+                                  "wscript.exe",
+                                  "PowerShell.EXE",
+                                  "Cmd.Exe",
+                                  "MSHTA.EXE",
+                                  "RUNDLL32.EXE",
+                                  "REGSVR32.EXE",
+                                  "MSBuild.exe",
+                                  "InstallUtil.exe",
+                                  "RegAsm.exe",
+                                  "RegSvcs.exe",
+                                  "msxsl.exe",
+                                  "CONTROL.EXE",
+                                  "EXPLORER.EXE",
+                                  "Microsoft.Workflow.Compiler.exe",
+                                  "msiexec.exe"
+                                  ) and
+    /* add suspicious paths here */
+    process.args : (
+       "C:\\Users\\*",
+       "C:\\ProgramData\\*",
+       "C:\\Windows\\Temp\\*",
+       "C:\\Windows\\Tasks\\*",
+       "C:\\PerfLogs\\*",
+       "C:\\Intel\\*",
+       "C:\\Windows\\Debug\\*",
+       "C:\\HP\\*") and
+
+     not (process.name : "cmd.exe" and process.args : "?:\\*.bat" and process.working_directory : "?:\\Windows\\System32\\") and
+     not (process.name : "cscript.exe" and process.args : "?:\\Windows\\system32\\calluxxprovider.vbs") and
+     not (process.name : "powershell.exe" and process.args : ("-File", "-PSConsoleFile") and user.id : "S-1-5-18") and
+     not (process.name : "msiexec.exe" and user.id : "S-1-5-18")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux.asciidoc
new file mode 100644
index 0000000000..22608b7f86
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux.asciidoc
@@ -0,0 +1,97 @@
+[[prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux]]
+=== Suspicious Execution via Windows Subsystem for Linux
+
+Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
+* https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
+* https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+  (
+    (
+      (process.executable : "?:\\Windows\\System32\\bash.exe" or ?process.pe.original_file_name == "Bash.exe") and 
+      not process.command_line : ("bash", "bash.exe")
+    ) or 
+    process.executable : "?:\\Users\\*\\AppData\\Local\\Packages\\*\\rootfs\\usr\\bin\\bash" or 
+    (
+      process.parent.name : "wsl.exe" and ?process.parent.command_line : "bash*" and not process.name : "wslhost.exe"
+    ) or 
+    (
+      process.name : "wsl.exe" and process.args : (
+        "curl", "/etc/shadow", "/etc/passwd", "cat", "--system", "root", "-e", "--exec", "bash", "/mnt/c/*"
+      ) and not process.args : ("wsl-bootstrap", "docker-desktop-data", "*.vscode-server*")
+    )
+  ) and 
+    not process.parent.executable : ("?:\\Program Files\\Docker\\*.exe", "?:\\Program Files (x86)\\Docker\\*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Unix Shell
+** ID: T1059.004
+** Reference URL: https://attack.mitre.org/techniques/T1059/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-explorer-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-explorer-child-process.asciidoc
new file mode 100644
index 0000000000..8da9674e6e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-explorer-child-process.asciidoc
@@ -0,0 +1,128 @@
+[[prebuilt-rule-8-12-8-suspicious-explorer-child-process]]
+=== Suspicious Explorer Child Process
+
+Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (
+   process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
+   process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE", "REGSVR32.EXE")
+  ) and
+  /* Explorer started via DCOM */
+  process.parent.name : "explorer.exe" and process.parent.args : "-Embedding" and
+  not process.parent.args:
+          (
+            /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs   */
+            "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
+            "/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}"
+          )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Sub-technique:
+** Name: Spearphishing Link
+** ID: T1566.002
+** Reference URL: https://attack.mitre.org/techniques/T1566/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
new file mode 100644
index 0000000000..d49a4d6bfc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
@@ -0,0 +1,182 @@
+[[prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office]]
+=== Suspicious Image Load (taskschd.dll) from MS Office
+
+Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.library-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
+* https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Image Load (taskschd.dll) from MS Office*
+
+
+Microsoft Office, a widely used suite of productivity applications, is frequently targeted by attackers due to its popularity in corporate environments. These attackers exploit its extensive capabilities, like macro scripts in Word and Excel, to gain initial access to systems. They often use Office documents as delivery mechanisms for malware or phishing attempts, taking advantage of their trusted status in professional settings.
+
+`taskschd.dll` provides Command Object Model (COM) interfaces for the Windows Task Scheduler service, allowing developers to programmatically manage scheduled tasks.
+
+This rule looks for an MS Office process loading `taskschd.dll`, which may indicate an adversary abusing COM to configure a scheduled task. This can happen as part of a phishing attack, when a malicious office document registers the scheduled task to download the malware "stage 2" or to establish persistent access.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Analyze the host's scheduled tasks and explore the related Windows events to determine if tasks were created or deleted (Event IDs 4698 and 4699).
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Examine the files downloaded during the past 24 hours.
+  - Identify files that are related or can be executed in MS Office.
+  - Identify and analyze macros that these documents contain.
+    - Identify suspicious traits in the office macros, such as encoded or encrypted sections.
+- Retrieve the suspicious files identified in the previous step and determine if they are malicious:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Related Rules*
+
+
+- Suspicious WMI Image Load from MS Office - 891cb88e-441a-4c3e-be2d-120d99fe7b0d
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (?dll.name : "taskschd.dll" or file.name : "taskschd.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-imagepath-service-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-imagepath-service-creation.asciidoc
new file mode 100644
index 0000000000..bf1790e8eb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-imagepath-service-creation.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-12-8-suspicious-imagepath-service-creation]]
+=== Suspicious ImagePath Service Creation
+
+Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and registry.path : (
+    "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath",
+    "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath"
+    ) and
+ /* add suspicious registry ImagePath values here */
+    registry.data.strings : ("%COMSPEC%*", "*\\.\\pipe\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook.asciidoc
new file mode 100644
index 0000000000..94cbfc6b4f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook.asciidoc
@@ -0,0 +1,91 @@
+[[prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook]]
+=== Suspicious Inter-Process Communication via Outlook
+
+Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Collection
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1m
+[process where host.os.type == "windows" and event.action == "start" and
+  (
+    process.name : (
+      "rundll32.exe", "mshta.exe", "powershell.exe", "pwsh.exe",
+      "cmd.exe", "regsvr32.exe", "cscript.exe", "wscript.exe"
+    ) or
+    (
+      (process.code_signature.trusted == false or process.code_signature.exists == false) and 
+      (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500)
+    )
+  )
+] by process.executable
+[process where host.os.type == "windows" and event.action == "start" and process.name : "OUTLOOK.EXE" and
+  process.Ext.effective_parent.name != null] by process.Ext.effective_parent.executable
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Collection
+** ID: TA0009
+** Reference URL: https://attack.mitre.org/tactics/TA0009/
+* Technique:
+** Name: Email Collection
+** ID: T1114
+** Reference URL: https://attack.mitre.org/techniques/T1114/
+* Sub-technique:
+** Name: Local Email Collection
+** ID: T1114.001
+** Reference URL: https://attack.mitre.org/techniques/T1114/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process.asciidoc
new file mode 100644
index 0000000000..1e66b5ed59
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process.asciidoc
@@ -0,0 +1,98 @@
+[[prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process]]
+=== Suspicious JetBrains TeamCity Child Process
+
+Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.executable :
+                 ("?:\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\Program Files\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\Program Files (x86)\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\TeamCity\\BuildAgent\\jre\\bin\\java.exe") and
+  process.name : ("cmd.exe", "powershell.exe", "msiexec.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "curl.exe", "ssh.exe",
+                   "rundll32.exe", "regsvr32.exe", "mshta.exe", "certreq.exe", "net.exe", "nltest.exe", "whoami.exe", "hostname.exe",
+                   "tasklist.exe", "arp.exe", "nbtstat.exe", "netstat.exe", "reg.exe", "tasklist.exe", "Microsoft.Workflow.Compiler.exe",
+                   "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe",
+                   "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "ieexec.exe", "iexpress.exe",
+                   "installutil.exe", "ipconfig.exe","msxsl.exe", "netsh.exe", "odbcconf.exe", "ping.exe", "pwsh.exe", "qprocess.exe",
+                   "quser.exe", "qwinsta.exe", "rcsi.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
+                   "systeminfo.exe", "tracert.exe", "wmic.exe", "wscript.exe","xwizard.exe", "explorer.exe", "msdt.exe") and
+ not (process.name : "powershell.exe" and process.args : "-ExecutionPolicy" and process.args : "?:\\TeamCity\\buildAgent\\work\\*.ps1") and
+ not (process.name : "cmd.exe" and process.args : "dir" and process.args : "/-c")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
new file mode 100644
index 0000000000..27e1f2c214
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -0,0 +1,92 @@
+[[prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution]]
+=== Suspicious Microsoft Diagnostics Wizard Execution
+
+Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://twitter.com/nao_sec/status/1530196847679401984
+* https://lolbas-project.github.io/lolbas/Binaries/Msdt/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+   (process.pe.original_file_name == "msdt.exe" or process.name : "msdt.exe") and
+   (
+    process.args : ("IT_RebrowseForFile=*", "ms-msdt:/id", "ms-msdt:-id", "*FromBase64*") or
+
+    (process.args : "-af" and process.args : "/skip" and
+     process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe", "cscript.exe", "wscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe") and
+     process.args : ("?:\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml", "PCWDiagnostic.xml", "?:\\Users\\Public\\*", "?:\\Windows\\Temp\\*")) or
+
+    (process.pe.original_file_name == "msdt.exe" and not process.name : "msdt.exe" and process.name != null) or
+
+    (process.pe.original_file_name == "msdt.exe" and not process.executable : ("?:\\Windows\\system32\\msdt.exe", "?:\\Windows\\SysWOW64\\msdt.exe"))
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass.asciidoc
new file mode 100644
index 0000000000..24759da3fe
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass.asciidoc
@@ -0,0 +1,147 @@
+[[prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass]]
+=== Suspicious Module Loaded by LSASS
+
+Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.xpnsec.com/exploring-mimikatz-part-2/
+* https://github.com/jas502n/mimikat_ssp
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and process.executable : "?:\\Windows\\System32\\lsass.exe" and
+  not (dll.code_signature.subject_name :
+               ("Microsoft Windows",
+                "Microsoft Corporation",
+                "Microsoft Windows Publisher",
+                "Microsoft Windows Software Compatibility Publisher",
+                "Microsoft Windows Hardware Compatibility Publisher",
+                "McAfee, Inc.",
+                "SecMaker AB",
+                "HID Global Corporation",
+                "HID Global",
+                "Apple Inc.",
+                "Citrix Systems, Inc.",
+                "Dell Inc",
+                "Hewlett-Packard Company",
+                "Symantec Corporation",
+                "National Instruments Corporation",
+                "DigitalPersona, Inc.",
+                "Novell, Inc.",
+                "gemalto",
+                "EasyAntiCheat Oy",
+                "Entrust Datacard Corporation",
+                "AuriStor, Inc.",
+                "LogMeIn, Inc.",
+                "VMware, Inc.",
+                "Istituto Poligrafico e Zecca dello Stato S.p.A.",
+                "Nubeva Technologies Ltd",
+                "Micro Focus (US), Inc.",
+                "Yubico AB",
+                "GEMALTO SA",
+                "Secure Endpoints, Inc.",
+                "Sophos Ltd",
+                "Morphisec Information Security 2014 Ltd",
+                "Entrust, Inc.",
+                "Nubeva Technologies Ltd",
+                "Micro Focus (US), Inc.",
+                "F5 Networks Inc",
+                "Bit4id",
+                "Thales DIS CPL USA, Inc.",
+                "Micro Focus International plc",
+                "HYPR Corp",
+                "Intel(R) Software Development Products",
+                "PGP Corporation",
+                "Parallels International GmbH",
+                "FrontRange Solutions Deutschland GmbH",
+                "SecureLink, Inc.",
+                "Tidexa OU",
+                "Amazon Web Services, Inc.",
+                "SentryBay Limited",
+                "Audinate Pty Ltd",
+                "CyberArk Software Ltd.",
+                "McAfeeSysPrep",
+                "NVIDIA Corporation PE Sign v2016",
+                "Trend Micro, Inc.",
+                "Fortinet Technologies (Canada) Inc.",
+                "Carbon Black, Inc.") and
+       dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining")) and
+
+     not dll.hash.sha256 :
+                ("811a03a5d7c03802676d2613d741be690b3461022ea925eb6b2651a5be740a4c",
+                 "1181542d9cfd63fb00c76242567446513e6773ea37db6211545629ba2ecf26a1",
+                 "ed6e735aa6233ed262f50f67585949712f1622751035db256811b4088c214ce3",
+                 "26be2e4383728eebe191c0ab19706188f0e9592add2e0bf86b37442083ae5e12",
+                 "9367e78b84ef30cf38ab27776605f2645e52e3f6e93369c674972b668a444faa",
+                 "d46cc934765c5ecd53867070f540e8d6f7701e834831c51c2b0552aba871921b",
+                 "0f77a3826d7a5cd0533990be0269d951a88a5c277bc47cff94553330b715ec61",
+                 "4aca034d3d85a9e9127b5d7a10882c2ef4c3e0daa3329ae2ac1d0797398695fb",
+                 "86031e69914d9d33c34c2f4ac4ae523cef855254d411f88ac26684265c981d95")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: LSASS Memory
+** ID: T1003.001
+** Reference URL: https://attack.mitre.org/techniques/T1003/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-office-child-process.asciidoc
new file mode 100644
index 0000000000..8362f0afcf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-office-child-process.asciidoc
@@ -0,0 +1,192 @@
+[[prebuilt-rule-8-12-8-suspicious-ms-office-child-process]]
+=== Suspicious MS Office Child Process
+
+Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/blog/vulnerability-summary-follina
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious MS Office Child Process*
+
+
+Microsoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.
+
+This rule looks for suspicious processes spawned by MS Office programs. This is generally the result of the execution of malicious documents.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : (
+      "eqnedt32.exe", "excel.exe", "fltldr.exe", "msaccess.exe",
+      "mspub.exe", "powerpnt.exe", "winword.exe", "outlook.exe"
+  ) and
+  process.name : (
+      "Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe",
+      "certutil.exe", "cmd.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe",
+      "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe", "iexpress.exe",
+      "installutil.exe", "ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe", "net1.exe", "netsh.exe",
+      "netstat.exe", "nltest.exe", "odbcconf.exe", "ping.exe", "powershell.exe", "pwsh.exe", "qprocess.exe",
+      "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe",
+      "schtasks.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe",
+      "xwizard.exe", "explorer.exe", "rundll32.exe", "hh.exe", "msdt.exe"
+  ) and
+  not (
+    process.parent.name : "outlook.exe" and
+    process.name : "rundll32.exe" and
+    process.args : "shell32.dll,Control_RunDLL" and
+    process.args : "srchadmin.dll"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process.asciidoc
new file mode 100644
index 0000000000..c60bd0664d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process.asciidoc
@@ -0,0 +1,179 @@
+[[prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process]]
+=== Suspicious MS Outlook Child Process
+
+Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious MS Outlook Child Process*
+
+
+Microsoft Outlook is an email client that provides contact, email calendar, and task management features. Outlook is widely used, either standalone or as part of the Office suite.
+
+This rule looks for suspicious processes spawned by MS Outlook, which can be the result of the execution of malicious documents and/or exploitation for initial access.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve recently opened files received via email and opened by the user that could cause this behavior. Common locations include but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "outlook.exe" and
+  process.name : ("Microsoft.Workflow.Compiler.exe", "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe",
+                  "cdb.exe", "certutil.exe", "cmd.exe", "cmstp.exe", "cscript.exe", "csi.exe", "dnx.exe", "dsget.exe",
+                  "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "hostname.exe", "ieexec.exe",
+                  "iexpress.exe", "installutil.exe", "ipconfig.exe", "mshta.exe", "msxsl.exe", "nbtstat.exe", "net.exe",
+                  "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "odbcconf.exe", "ping.exe", "powershell.exe",
+                  "pwsh.exe", "qprocess.exe", "quser.exe", "qwinsta.exe", "rcsi.exe", "reg.exe", "regasm.exe",
+                  "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe", "systeminfo.exe", "tasklist.exe",
+                  "tracert.exe", "whoami.exe", "wmic.exe", "wscript.exe", "xwizard.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-code-compilation.asciidoc
new file mode 100644
index 0000000000..5846d9af29
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-code-compilation.asciidoc
@@ -0,0 +1,97 @@
+[[prebuilt-rule-8-12-8-suspicious-net-code-compilation]]
+=== Suspicious .NET Code Compilation
+
+Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt to compile code after delivery in order to bypass security mechanisms.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("csc.exe", "vbc.exe") and
+  process.parent.name : ("wscript.exe", "mshta.exe", "cscript.exe", "wmic.exe", "svchost.exe", "rundll32.exe", "cmstp.exe", "regsvr32.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Obfuscated Files or Information
+** ID: T1027
+** Reference URL: https://attack.mitre.org/techniques/T1027/
+* Sub-technique:
+** Name: Compile After Delivery
+** ID: T1027.004
+** Reference URL: https://attack.mitre.org/techniques/T1027/004/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell.asciidoc
new file mode 100644
index 0000000000..0ff82762ef
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell.asciidoc
@@ -0,0 +1,200 @@
+[[prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell]]
+=== Suspicious .NET Reflection via PowerShell
+
+Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 212
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious .NET Reflection via PowerShell*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.
+- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Examine file or network events from the involved PowerShell process for suspicious behavior.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Evaluate whether the user needs to use PowerShell to complete tasks.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the script using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.
+
+
+*Related rules*
+
+
+- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe
+- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d
+- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    "[System.Reflection.Assembly]::Load" or
+    "[Reflection.Assembly]::Load"
+  ) and
+  not powershell.file.script_block_text : (
+        ("CommonWorkflowParameters" or "RelatedLinksHelpInfo") and
+        "HelpDisplayStrings"
+  ) and
+  not (powershell.file.script_block_text :
+        ("Get-SolutionFiles" or "Get-VisualStudio" or "Select-MSBuildPath") and
+        file.name : "PathFunctions.ps1"
+  ) and
+  not user.id : "S-1-5-18"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Reflective Code Loading
+** ID: T1620
+** Reference URL: https://attack.mitre.org/techniques/T1620/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Sub-technique:
+** Name: Dynamic-link Library Injection
+** ID: T1055.001
+** Reference URL: https://attack.mitre.org/techniques/T1055/001/
+* Sub-technique:
+** Name: Portable Executable Injection
+** ID: T1055.002
+** Reference URL: https://attack.mitre.org/techniques/T1055/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process.asciidoc
new file mode 100644
index 0000000000..d7cf232ea8
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process.asciidoc
@@ -0,0 +1,166 @@
+[[prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process]]
+=== Suspicious PDF Reader Child Process
+
+Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Initial Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious PDF Reader Child Process*
+
+
+PDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.
+
+This rule looks for commonly abused built-in utilities spawned by a PDF reader process, which is likely a malicious behavior.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Retrieve PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.
+- Determine if the collected files are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+  - If the malicious file was delivered via phishing:
+    - Block the email sender from sending future emails.
+    - Block the malicious web pages.
+    - Remove emails from the sender from mailboxes.
+    - Consider improvements to the security awareness program.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("AcroRd32.exe",
+                         "Acrobat.exe",
+                         "FoxitPhantomPDF.exe",
+                         "FoxitReader.exe") and
+  process.name : ("arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe",
+                  "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe",
+                  "quser.exe", "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe",
+                  "whoami.exe", "bginfo.exe", "cdb.exe", "cmstp.exe", "csi.exe", "dnx.exe", "fsi.exe", "ieexec.exe",
+                  "iexpress.exe", "installutil.exe", "Microsoft.Workflow.Compiler.exe", "msbuild.exe", "mshta.exe",
+                  "msxsl.exe", "odbcconf.exe", "rcsi.exe", "regsvr32.exe", "xwizard.exe", "atbroker.exe",
+                  "forfiles.exe", "schtasks.exe", "regasm.exe", "regsvcs.exe", "cmd.exe", "cscript.exe",
+                  "powershell.exe", "pwsh.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "ftp.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload.asciidoc
new file mode 100644
index 0000000000..b9aed377e3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload.asciidoc
@@ -0,0 +1,137 @@
+[[prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload]]
+=== Suspicious PowerShell Engine ImageLoad
+
+Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 210
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious PowerShell Engine ImageLoad*
+
+
+PowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.
+
+Attackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called "PowerShell without PowerShell," works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Retrieve the implementation (DLL, executable, etc.) and determine if it is malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:library and 
+  dll.name:("System.Management.Automation.dll" or "System.Management.Automation.ni.dll") and 
+  not (
+    process.code_signature.subject_name:("Microsoft Corporation" or "Microsoft Dynamic Code Publisher" or "Microsoft Windows") and process.code_signature.trusted:true and not process.name.caseless:("regsvr32.exe" or "rundll32.exe")
+  ) and 
+  not (
+    process.executable.caseless:(C\:\\Program*Files*\(x86\)\\*.exe or C\:\\Program*Files\\*.exe) and
+    process.code_signature.trusted:true
+  ) and 
+  not (
+    process.executable.caseless: C\:\\Windows\\Lenovo\\*.exe and process.code_signature.subject_name:"Lenovo" and 
+    process.code_signature.trusted:true
+  ) and 
+  not (
+    process.executable.caseless: "C:\\ProgramData\\chocolatey\\choco.exe" and
+    process.code_signature.subject_name:"Chocolatey Software, Inc." and process.code_signature.trusted:true
+  ) and not process.executable.caseless : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion.asciidoc
new file mode 100644
index 0000000000..6bf0a94c1a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion]]
+=== Suspicious Print Spooler File Deletion
+
+Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type : "deletion" and
+ not process.name : ("spoolsv.exe", "dllhost.exe", "explorer.exe") and
+ file.path : "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\*.dll"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll.asciidoc
new file mode 100644
index 0000000000..d40e076a77
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll.asciidoc
@@ -0,0 +1,80 @@
+[[prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll]]
+=== Suspicious Print Spooler Point and Print DLL
+
+Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability
+* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Privilege%20Escalation/privesc_sysmon_cve_20201030_spooler.evtx
+* https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1030
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 106
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id with maxspan=30s
+[registry where host.os.type == "windows" and
+ registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\SpoolDirectory"
+    ) and
+ registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4"]
+[registry where host.os.type == "windows" and
+ registry.path : (
+    "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module",
+    "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\*\\CopyFiles\\Payload\\Module"
+    ) and
+ registry.data.strings : "C:\\Windows\\System32\\spool\\drivers\\x64\\4\\*"]
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created.asciidoc
new file mode 100644
index 0000000000..a1fc2539af
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created.asciidoc
@@ -0,0 +1,169 @@
+[[prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created]]
+=== Suspicious Print Spooler SPL File Created
+
+Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://safebreach.com/Post/How-we-bypassed-CVE-2020-1048-Patch-and-got-CVE-2020-1337
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Print Spooler SPL File Created*
+
+
+Print Spooler is a Windows service enabled by default in all Windows clients and servers. The service manages print jobs by loading printer drivers, receiving files to be printed, queuing them, scheduling, etc.
+
+The Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\Windows\System32\spool\PRINTERS\`, which is an essential step in exploiting these vulnerabilities.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Ensure that the machine has the latest security updates and is not running legacy Windows versions.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.extension : "spl" and
+  file.path : "?:\\Windows\\System32\\spool\\PRINTERS\\*" and
+  not process.name : ("spoolsv.exe",
+                      "printfilterpipelinesvc.exe",
+                      "PrintIsolationHost.exe",
+                      "splwow64.exe",
+                      "msiexec.exe",
+                      "poqexec.exe",
+                      "System") and
+  not user.id : "S-1-5-18" and
+  not process.executable :
+            ("?:\\Windows\\System32\\mmc.exe",
+             "\\Device\\Mup\\*.exe",
+             "?:\\Windows\\System32\\svchost.exe",
+             "?:\\Windows\\System32\\mmc.exe",
+             "?:\\Windows\\System32\\printui.exe",
+             "?:\\Windows\\System32\\mstsc.exe",
+             "?:\\Windows\\System32\\spool\\*.exe",
+             "?:\\Program Files\\*.exe",
+             "?:\\Program Files (x86)\\*.exe",
+             "?:\\PROGRA~1\\*.exe",
+             "?:\\PROGRA~2\\*.exe",
+             "?:\\Windows\\System32\\rundll32.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation.asciidoc
new file mode 100644
index 0000000000..79a224ebb0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation.asciidoc
@@ -0,0 +1,94 @@
+[[prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation]]
+=== Suspicious PrintSpooler Service Executable File Creation
+
+Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/
+* https://www.thezdi.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+  process.name : "spoolsv.exe" and file.extension : "dll" and
+  file.path : ("?:\\Windows\\System32\\*", "?:\\Windows\\SysWOW64\\*") and
+  not file.path : (
+    "?:\\WINDOWS\\SysWOW64\\PrintConfig.dll",
+    "?:\\WINDOWS\\system32\\x5lrs.dll",
+    "?:\\WINDOWS\\sysWOW64\\x5lrs.dll",
+    "?:\\WINDOWS\\system32\\PrintConfig.dll",
+    "?:\\WINDOWS\\system32\\spool\\DRIVERS\\x64\\*.dll",
+    "?:\\WINDOWS\\system32\\spool\\DRIVERS\\W32X86\\*.dll",
+    "?:\\WINDOWS\\system32\\spool\\PRTPROCS\\x64\\*.dll",
+    "?:\\WINDOWS\\system32\\spool\\{????????-????-????-????-????????????}\\*.dll"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
new file mode 100644
index 0000000000..4f44d65893
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -0,0 +1,142 @@
+[[prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable]]
+=== Suspicious Process Execution via Renamed PsExec Executable
+
+Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Process Execution via Renamed PsExec Executable*
+
+
+PsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.
+
+This rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.
+
+
+*Possible investigation steps*
+
+
+- Check if the usage of this tool complies with the organization's administration policy.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Identify the target computer and its role in the IT environment.
+- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+  - Prioritize cases involving critical servers and users.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.pe.original_file_name : "psexesvc.exe" and not process.name : "PSEXESVC.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: System Services
+** ID: T1569
+** Reference URL: https://attack.mitre.org/techniques/T1569/
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Rename System Utilities
+** ID: T1036.003
+** Reference URL: https://attack.mitre.org/techniques/T1036/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded.asciidoc
new file mode 100644
index 0000000000..69c4871f45
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded.asciidoc
@@ -0,0 +1,105 @@
+[[prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded]]
+=== Suspicious RDP ActiveX Client Loaded
+
+Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+ (?dll.name : "mstscax.dll" or file.name : "mstscax.dll") and
+   /* depending on noise in your env add here extra paths  */
+  process.executable : (
+    "C:\\Windows\\*",
+    "C:\\Users\\Public\\*",
+    "C:\\Users\\Default\\*",
+    "C:\\Intel\\*",
+    "C:\\PerfLogs\\*",
+    "C:\\ProgramData\\*",
+    "\\Device\\Mup\\*",
+    "\\\\*"
+  ) and
+  /* add here FPs */
+  not process.executable : (
+    "?:\\Windows\\System32\\mstsc.exe",
+    "?:\\Windows\\SysWOW64\\mstsc.exe",
+    "?:\\Windows\\System32\\vmconnect.exe",
+    "?:\\Windows\\System32\\WindowsSandboxClient.exe",
+    "?:\\Windows\\System32\\hvsirdpclient.exe"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: Remote Desktop Protocol
+** ID: T1021.001
+** Reference URL: https://attack.mitre.org/techniques/T1021/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process.asciidoc
new file mode 100644
index 0000000000..d80be6eb47
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process.asciidoc
@@ -0,0 +1,86 @@
+[[prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process]]
+=== Suspicious ScreenConnect Client Child Process
+
+Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* logs-system.security*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name :
+                ("ScreenConnect.ClientService.exe",
+                 "ScreenConnect.WindowsClient.exe",
+                 "ScreenConnect.WindowsBackstageShell.exe",
+                 "ScreenConnect.WindowsFileManager.exe") and
+  (
+   (process.name : "powershell.exe" and
+    process.args : ("-enc", "-ec", "-e", "*downloadstring*", "*Reflection.Assembly*", "*http*")) or
+   (process.name : "cmd.exe" and process.args : "/c") or
+   (process.name : "net.exe" and process.args : "/add") or
+   (process.name : "schtasks.exe" and process.args : ("/create", "-create")) or
+   (process.name : "sc.exe" and process.args : "create") or
+   (process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
+   (process.name : "msiexec.exe" and process.args : ("/i", "-i") and
+    process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
+   process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe", 
+                   "ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
+   )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-solarwinds-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-solarwinds-child-process.asciidoc
new file mode 100644
index 0000000000..2d047492c5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-solarwinds-child-process.asciidoc
@@ -0,0 +1,109 @@
+[[prebuilt-rule-8-12-8-suspicious-solarwinds-child-process]]
+=== Suspicious SolarWinds Child Process
+
+A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
+* https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20CHILD%20PROCESSES%20(METHODOLOGY).ioc
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name: ("SolarWinds.BusinessLayerHost.exe", "SolarWinds.BusinessLayerHostx64.exe") and
+ not (
+    process.name : (
+        "APMServiceControl*.exe",
+        "ExportToPDFCmd*.Exe",
+        "SolarWinds.Credentials.Orion.WebApi*.exe",
+        "SolarWinds.Orion.Topology.Calculator*.exe",
+        "Database-Maint.exe",
+        "SolarWinds.Orion.ApiPoller.Service.exe",
+        "WerFault.exe",
+        "WerMgr.exe",
+        "SolarWinds.BusinessLayerHost.exe",
+        "SolarWinds.BusinessLayerHostx64.exe",
+        "SolarWinds.Topology.Calculator.exe",
+        "SolarWinds.Topology.Calculatorx64.exe",
+        "SolarWinds.APM.RealTimeProcessPoller.exe") and
+    process.code_signature.trusted == true
+ ) and
+ not process.executable : ("?:\\Windows\\SysWOW64\\ARP.EXE", "?:\\Windows\\SysWOW64\\lodctr.exe", "?:\\Windows\\SysWOW64\\unlodctr.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Native API
+** ID: T1106
+** Reference URL: https://attack.mitre.org/techniques/T1106/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Supply Chain Compromise
+** ID: T1195
+** Reference URL: https://attack.mitre.org/techniques/T1195/
+* Sub-technique:
+** Name: Compromise Software Supply Chain
+** ID: T1195.002
+** Reference URL: https://attack.mitre.org/techniques/T1195/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification.asciidoc
new file mode 100644
index 0000000000..df794492e4
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification.asciidoc
@@ -0,0 +1,165 @@
+[[prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification]]
+=== Suspicious Startup Shell Folder Modification
+
+Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Startup Shell Folder Modification*
+
+
+Techniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Review the source process and related file tied to the Windows Registry entry.
+- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the file using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based on new software installations, patches, or other network administrator activity. Before undertaking further investigation, it should be verified that this activity is not benign.
+
+
+*Related rules*
+
+
+- Startup or Run Key Registry Modification - 97fc44d3-8dae-4019-ae83-298c3015600f
+- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+ registry.path : (
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "HKU\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
+     "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
+     "\\REGISTRY\\USER\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup"
+     ) and
+  registry.data.strings != null and
+  /* Normal Startup Folder Paths */
+  not registry.data.strings : (
+           "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
+           "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
+           )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-werfault-child-process.asciidoc
new file mode 100644
index 0000000000..39cbe0a7c0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-werfault-child-process.asciidoc
@@ -0,0 +1,115 @@
+[[prebuilt-rule-8-12-8-suspicious-werfault-child-process]]
+=== Suspicious WerFault Child Process
+
+A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/
+* https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/
+* https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx
+* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Persistence
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+
+  process.parent.name : "WerFault.exe" and 
+  
+  /* args -s and -t used to execute a process via SilentProcessExit mechanism */
+  (process.parent.args : "-s" and process.parent.args : "-t" and process.parent.args : "-c") and 
+  
+  not process.executable : ("?:\\Windows\\SysWOW64\\Initcrypt.exe", "?:\\Program Files (x86)\\Heimdal\\Heimdal.Guard.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Image File Execution Options Injection
+** ID: T1546.012
+** Reference URL: https://attack.mitre.org/techniques/T1546/012/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
new file mode 100644
index 0000000000..216598c8aa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
@@ -0,0 +1,124 @@
+[[prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host]]
+=== Suspicious Windows Process Cluster Spawned by a Host
+
+A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
new file mode 100644
index 0000000000..0b4c186ed3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process]]
+=== Suspicious Windows Process Cluster Spawned by a Parent Process
+
+A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
new file mode 100644
index 0000000000..74ca70963a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user]]
+=== Suspicious Windows Process Cluster Spawned by a User
+
+A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office.asciidoc
new file mode 100644
index 0000000000..e5121ef50a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office]]
+=== Suspicious WMI Image Load from MS Office
+
+Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.library-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and
+ (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
+  process.name : ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "MSPUB.EXE", "MSACCESS.EXE") and
+  (?dll.name : "wmiutils.dll" or file.name : "wmiutils.dll")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-zoom-child-process.asciidoc
new file mode 100644
index 0000000000..3fe1971b74
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-suspicious-zoom-child-process.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-12-8-suspicious-zoom-child-process]]
+=== Suspicious Zoom Child Process
+
+A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Suspicious Zoom Child Process*
+
+
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading, and deserve further investigation.
+
+This rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the command line of the child process to determine which commands or scripts were executed.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "Zoom.exe" and process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-svchost-spawning-cmd.asciidoc
new file mode 100644
index 0000000000..19424ceea7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-svchost-spawning-cmd.asciidoc
@@ -0,0 +1,143 @@
+[[prebuilt-rule-8-12-8-svchost-spawning-cmd]]
+=== Svchost spawning Cmd
+
+Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe
+
+*Rule type*: new_terms
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 211
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Svchost spawning Cmd*
+
+
+The Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be used by non-Windows services.
+
+This rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+host.os.type:windows and event.category:process and event.type:start and process.parent.name:"svchost.exe" and process.name:("cmd.exe" or "Cmd.exe" or "CMD.EXE")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created.asciidoc
new file mode 100644
index 0000000000..8f60e60e23
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created.asciidoc
@@ -0,0 +1,172 @@
+[[prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created]]
+=== Symbolic Link to Shadow Copy Created
+
+Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink
+* https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+* https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/
+* https://www.hackingarticles.in/credential-dumping-ntds-dit/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Symbolic Link to Shadow Copy Created*
+
+
+Shadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Determine if a volume shadow copy was recently created on this endpoint.
+- Review privileges of the end user as this requires administrative access.
+- Verify if the ntds.dit file was successfully copied and determine its copy destination.
+- Investigate for registry SYSTEM file copies made recently or saved via Reg.exe.
+- Investigate recent deletions of volume shadow copies.
+- Identify other files potentially copied from volume shadow copy paths directly.
+
+
+*False positive analysis*
+
+
+- This rule should cause very few false positives. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related rules*
+
+
+- NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- If the entire domain or the `krbtgt` user was compromised:
+  - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.
+- Locate and remove static files copied from volume shadow copies.
+- Command-Line tool mklink should require administrative access by default unless in developer mode.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+Ensure advanced audit policies for Windows are enabled, specifically:
+Object Access policies https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656[Event ID 4656] (Handle to an Object was Requested)
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+System Audit Policies >
+Object Access >
+Audit File System (Success,Failure)
+Audit Handle Manipulation (Success,Failure)
+```
+
+This event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments.
+Direct access to a shell and calling symbolic link creation tools will not generate an event matching this rule.
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (
+    (?process.pe.original_file_name in ("Cmd.Exe","PowerShell.EXE")) or
+    (process.name : ("cmd.exe", "powershell.exe"))
+ ) and
+
+ /* Create Symbolic Link to Shadow Copies */
+ process.args : ("*mklink*", "*SymbolicLink*") and process.command_line : ("*HarddiskVolumeShadowCopy*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Sub-technique:
+** Name: NTDS
+** ID: T1003.003
+** Reference URL: https://attack.mitre.org/techniques/T1003/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-system-shells-via-services.asciidoc
new file mode 100644
index 0000000000..7a81ba5aba
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-system-shells-via-services.asciidoc
@@ -0,0 +1,145 @@
+[[prebuilt-rule-8-12-8-system-shells-via-services]]
+=== System Shells via Services
+
+Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating System Shells via Services*
+
+
+Attackers may configure existing services or create new ones to execute system shells to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these shells with persistence payloads.
+
+This rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).
+  - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.
+    - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+    - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+    - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Check for commands executed under the spawned shell.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Delete the service or restore it to the original configuration.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "services.exe" and
+  process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+
+  /* Third party FP's */
+  not process.args : "NVDisplay.ContainerLocalSystem"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process.asciidoc
new file mode 100644
index 0000000000..8927914baf
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process.asciidoc
@@ -0,0 +1,164 @@
+[[prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process]]
+=== Third-party Backup Files Deleted via Unexpected Process
+
+Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Third-party Backup Files Deleted via Unexpected Process*
+
+
+Backups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing data recovery, making them a valuable target.
+
+Attackers can delete backups from the host and gain access to backup servers to remove centralized backups for the environment, ensuring that victims have no alternatives to paying the ransom.
+
+This rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete Veritas or Veeam backups.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if any files on the host machine have been encrypted.
+
+
+*False positive analysis*
+
+
+- This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are not from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.
+
+
+*Related rules*
+
+
+- Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Perform data recovery locally or restore the backups from replicated copies (Cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "deletion" and
+  (
+    /* Veeam Related Backup Files */
+    (
+      file.extension : ("VBK", "VIB", "VBM") and
+      not (
+        process.executable : ("?:\\Windows\\*", "?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
+        (process.code_signature.trusted == true and process.code_signature.subject_name : ("Veeam Software Group GmbH", "Veeam Software AG"))
+      )
+    ) or
+    /* Veritas Backup Exec Related Backup File */
+    (
+      file.extension : "BKF" and
+        not process.executable : (
+          "?:\\Program Files\\Veritas\\Backup Exec\\*",
+          "?:\\Program Files (x86)\\Veritas\\Backup Exec\\*"
+        )
+    )
+  ) and
+  not (
+    process.name : ("MSExchangeMailboxAssistants.exe", "Microsoft.PowerBI.EnterpriseGateway.exe") and
+      (process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true)
+  ) and
+  not file.path : (
+    "?:\\ProgramData\\Trend Micro\\*",
+    "?:\\Program Files (x86)\\Trend Micro\\*",
+    "?:\\$RECYCLE.BIN\\*"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
+* Technique:
+** Name: Data Destruction
+** ID: T1485
+** Reference URL: https://attack.mitre.org/techniques/T1485/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
new file mode 100644
index 0000000000..f5e92479ce
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
@@ -0,0 +1,115 @@
+[[prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer]]
+=== UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
+
+Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.executable : "C:\\*\\AppData\\*\\Temp\\IDC*.tmp\\*.exe" and
+ process.parent.name : "ieinstal.exe" and process.parent.args : "-Embedding"
+
+ /* uncomment once in winlogbeat */
+ /* and not (process.code_signature.subject_name == "Microsoft Corporation" and process.code_signature.trusted == true) */
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
new file mode 100644
index 0000000000..32ebd11d59
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
@@ -0,0 +1,110 @@
+[[prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface]]
+=== UAC Bypass Attempt via Privileged IFileOperation COM Interface
+
+Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/hfiref0x/UACME
+* https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type : "change" and process.name : "dllhost.exe" and
+  /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */
+  file.name : ("wow64log.dll", "comctl32.dll", "DismCore.dll", "OskSupport.dll", "duser.dll", "Accessibility.ni.dll") and
+  /* has no impact on rule logic just to avoid OS install related FPs */
+  not file.path : ("C:\\Windows\\SoftwareDistribution\\*", "C:\\Windows\\WinSxS\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
new file mode 100644
index 0000000000..6b3cf4d5cc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -0,0 +1,174 @@
+[[prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading]]
+=== UAC Bypass Attempt via Windows Directory Masquerading
+
+Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 112
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating UAC Bypass Attempt via Windows Directory Masquerading*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+This rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze any suspicious spawned processes using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : ("C:\\Windows \\system32\\*.exe", "C:\\Windows \\SysWOW64\\*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Match Legitimate Name or Location
+** ID: T1036.005
+** Reference URL: https://attack.mitre.org/techniques/T1036/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
new file mode 100644
index 0000000000..8300758b05
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
@@ -0,0 +1,113 @@
+[[prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface]]
+=== UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
+
+Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/hfiref0x/UACME
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "Clipup.exe" and
+  not process.executable : "C:\\Windows\\System32\\ClipUp.exe" and process.parent.name : "dllhost.exe" and
+  /* CLSID of the Elevated COM Interface IEditionUpgradeManager */
+  process.parent.args : "/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
new file mode 100644
index 0000000000..29abfeab6f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
@@ -0,0 +1,112 @@
+[[prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack]]
+=== UAC Bypass via DiskCleanup Scheduled Task Hijack
+
+Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.args : "/autoclean" and process.args : "/d" and process.executable != null and 
+ not process.executable : ("C:\\Windows\\System32\\cleanmgr.exe",
+                           "C:\\Windows\\SysWOW64\\cleanmgr.exe",
+                           "C:\\Windows\\System32\\taskhostw.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Scheduled Task/Job
+** ID: T1053
+** Reference URL: https://attack.mitre.org/techniques/T1053/
+* Sub-technique:
+** Name: Scheduled Task
+** ID: T1053.005
+** Reference URL: https://attack.mitre.org/techniques/T1053/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
new file mode 100644
index 0000000000..cad1786dcb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
@@ -0,0 +1,111 @@
+[[prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface]]
+=== UAC Bypass via ICMLuaUtil Elevated COM Interface
+
+Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name == "dllhost.exe" and
+ process.parent.args in ("/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}", "/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}") and
+ process.pe.original_file_name != "WerFault.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Inter-Process Communication
+** ID: T1559
+** Reference URL: https://attack.mitre.org/techniques/T1559/
+* Sub-technique:
+** Name: Component Object Model
+** ID: T1559.001
+** Reference URL: https://attack.mitre.org/techniques/T1559/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
new file mode 100644
index 0000000000..4f2544b254
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -0,0 +1,177 @@
+[[prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack]]
+=== UAC Bypass via Windows Firewall Snap-In Hijack
+
+Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/AzAgarampur/byeintegrity-uac
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating UAC Bypass via Windows Firewall Snap-In Hijack*
+
+
+Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.
+
+For more information about the UAC and how it works, check the https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works[official Microsoft docs page].
+
+This rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze any suspicious spawned processes using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name == "mmc.exe" and
+ /* process.Ext.token.integrity_level_name == "high" can be added in future for tuning */
+ /* args of the Windows Firewall SnapIn */
+  process.parent.args == "WF.msc" and process.name != "WerFault.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Abuse Elevation Control Mechanism
+** ID: T1548
+** Reference URL: https://attack.mitre.org/techniques/T1548/
+* Sub-technique:
+** Name: Bypass User Account Control
+** ID: T1548.002
+** Reference URL: https://attack.mitre.org/techniques/T1548/002/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: MMC
+** ID: T1218.014
+** Reference URL: https://attack.mitre.org/techniques/T1218/014/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uncommon-registry-persistence-change.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uncommon-registry-persistence-change.asciidoc
new file mode 100644
index 0000000000..dac84e3021
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-uncommon-registry-persistence-change.asciidoc
@@ -0,0 +1,142 @@
+[[prebuilt-rule-8-12-8-uncommon-registry-persistence-change]]
+=== Uncommon Registry Persistence Change
+
+Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoftpressstore.com/articles/article.aspx?p=2762082&seqNum=2
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 107
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+ length(registry.data.strings) > 0 and
+ registry.path : (
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Terminal Server\\Install\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Runonce\\*",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IconServiceLib",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AppSetup",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Taskman",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\VmApplet",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+      "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
+      "HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\*\\ShellComponent",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnConnect\\MicrosoftActiveSync",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows CE Services\\AutoStartOnDisconnect\\MicrosoftActiveSync",
+      "HKLM\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+      "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+      "HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+      "HKLM\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Script",
+      "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
+      "HKEY_USERS\\*\\Control Panel\\Desktop\\scrnsave.exe",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\*\\VerifierDlls",
+      "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\GpExtensions\\*\\DllName",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\SafeBoot\\AlternateShell",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\Wds\\rdpwd\\StartupPrograms",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\InitialProgram",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\BootExecute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\SetupExecute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\Execute",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\Session Manager\\S0InitialCommand",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\ServiceControlManagerExtension",
+      "HKLM\\SYSTEM\\ControlSet*\\Control\\BootVerificationProgram\\ImagePath",
+      "HKLM\\SYSTEM\\Setup\\CmdLine",
+      "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript") and
+
+ not registry.data.strings : ("C:\\Windows\\system32\\userinit.exe", "cmd.exe", "C:\\Program Files (x86)\\*.exe",
+                              "C:\\Program Files\\*.exe") and
+ not (process.name : "rundll32.exe" and registry.path : "*\\Software\\Microsoft\\Internet Explorer\\Extensions\\*\\Script") and
+ not process.executable : ("C:\\Windows\\System32\\msiexec.exe",
+                           "C:\\Windows\\SysWOW64\\msiexec.exe",
+                           "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe",
+                           "C:\\Program Files\\*.exe",
+                           "C:\\Program Files (x86)\\*.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Boot or Logon Autostart Execution
+** ID: T1547
+** Reference URL: https://attack.mitre.org/techniques/T1547/
+* Sub-technique:
+** Name: Registry Run Keys / Startup Folder
+** ID: T1547.001
+** Reference URL: https://attack.mitre.org/techniques/T1547/001/
+* Technique:
+** Name: Event Triggered Execution
+** ID: T1546
+** Reference URL: https://attack.mitre.org/techniques/T1546/
+* Sub-technique:
+** Name: Screensaver
+** ID: T1546.002
+** Reference URL: https://attack.mitre.org/techniques/T1546/002/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost.asciidoc
new file mode 100644
index 0000000000..c778c4d638
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost.asciidoc
@@ -0,0 +1,179 @@
+[[prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost]]
+=== Unsigned DLL Loaded by Svchost
+
+Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Data Source: Elastic Defend
+
+*Version*: 6
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and
+
+ process.executable : 
+     ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\Syswow64\\svchost.exe") and 
+     
+ dll.code_signature.trusted != true and 
+ 
+ not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*") and 
+ 
+ dll.hash.sha256 != null and 
+ 
+ (
+       /* DLL created within 5 minutes of the library load event - compatible with Elastic Endpoint 8.4+ */
+       dll.Ext.relative_file_creation_time <= 300 or 
+   
+       /* unusual paths */
+       dll.path :("?:\\ProgramData\\*",
+                  "?:\\Users\\*",
+                  "?:\\PerfLogs\\*",
+                  "?:\\Windows\\Tasks\\*",
+                  "?:\\Intel\\*",
+                  "?:\\AMD\\Temp\\*",
+                  "?:\\Windows\\AppReadiness\\*",
+                  "?:\\Windows\\ServiceState\\*",
+                  "?:\\Windows\\security\\*",
+                  "?:\\Windows\\IdentityCRL\\*",
+                  "?:\\Windows\\Branding\\*",
+                  "?:\\Windows\\csc\\*",
+                  "?:\\Windows\\DigitalLocker\\*",
+                  "?:\\Windows\\en-US\\*",
+                  "?:\\Windows\\wlansvc\\*",
+                  "?:\\Windows\\Prefetch\\*",
+                  "?:\\Windows\\Fonts\\*",
+                  "?:\\Windows\\diagnostics\\*",
+                  "?:\\Windows\\TAPI\\*",
+                  "?:\\Windows\\INF\\*",
+                  "?:\\Windows\\System32\\Speech\\*",
+                  "?:\\windows\\tracing\\*",
+                  "?:\\windows\\IME\\*",
+                  "?:\\Windows\\Performance\\*",
+                  "?:\\windows\\intel\\*",
+                  "?:\\windows\\ms\\*",
+                  "?:\\Windows\\dot3svc\\*",
+                  "?:\\Windows\\panther\\*",
+                  "?:\\Windows\\RemotePackages\\*",
+                  "?:\\Windows\\OCR\\*",
+                  "?:\\Windows\\appcompat\\*",
+                  "?:\\Windows\\apppatch\\*",
+                  "?:\\Windows\\addins\\*",
+                  "?:\\Windows\\Setup\\*",
+                  "?:\\Windows\\Help\\*",
+                  "?:\\Windows\\SKB\\*",
+                  "?:\\Windows\\Vss\\*",
+                  "?:\\Windows\\servicing\\*",
+                  "?:\\Windows\\CbsTemp\\*",
+                  "?:\\Windows\\Logs\\*",
+                  "?:\\Windows\\WaaS\\*",
+                  "?:\\Windows\\twain_32\\*",
+                  "?:\\Windows\\ShellExperiences\\*",
+                  "?:\\Windows\\ShellComponents\\*",
+                  "?:\\Windows\\PLA\\*",
+                  "?:\\Windows\\Migration\\*",
+                  "?:\\Windows\\debug\\*",
+                  "?:\\Windows\\Cursors\\*",
+                  "?:\\Windows\\Containers\\*",
+                  "?:\\Windows\\Boot\\*",
+                  "?:\\Windows\\bcastdvr\\*",
+                  "?:\\Windows\\TextInput\\*",
+                  "?:\\Windows\\security\\*",
+                  "?:\\Windows\\schemas\\*",
+                  "?:\\Windows\\SchCache\\*",
+                  "?:\\Windows\\Resources\\*",
+                  "?:\\Windows\\rescache\\*",
+                  "?:\\Windows\\Provisioning\\*",
+                  "?:\\Windows\\PrintDialog\\*",
+                  "?:\\Windows\\PolicyDefinitions\\*",
+                  "?:\\Windows\\media\\*",
+                  "?:\\Windows\\Globalization\\*",
+                  "?:\\Windows\\L2Schemas\\*",
+                  "?:\\Windows\\LiveKernelReports\\*",
+                  "?:\\Windows\\ModemLogs\\*",
+                  "?:\\Windows\\ImmersiveControlPanel\\*",
+                  "?:\\$Recycle.Bin\\*")
+  ) and 
+  
+  not dll.hash.sha256 : 
+            ("3ed33e71641645367442e65dca6dab0d326b22b48ef9a4c2a2488e67383aa9a6", 
+             "b4db053f6032964df1b254ac44cb995ffaeb4f3ade09597670aba4f172cf65e4", 
+             "214c75f678bc596bbe667a3b520aaaf09a0e50c364a28ac738a02f867a085eba", 
+             "23aa95b637a1bf6188b386c21c4e87967ede80242327c55447a5bb70d9439244", 
+             "5050b025909e81ae5481db37beb807a80c52fc6dd30c8aa47c9f7841e2a31be7")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: System Services
+** ID: T1569
+** Reference URL: https://attack.mitre.org/techniques/T1569/
+* Sub-technique:
+** Name: Service Execution
+** ID: T1569.002
+** Reference URL: https://attack.mitre.org/techniques/T1569/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
new file mode 100644
index 0000000000..d8a860208e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
@@ -0,0 +1,167 @@
+[[prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder]]
+=== Unsigned DLL Side-Loading from a Suspicious Folder
+
+Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and
+
+ process.code_signature.trusted == true and 
+ 
+ (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and 
+ 
+  not dll.code_signature.status : ("trusted", "errorExpired", "errorCode_endpoint*", "errorChaining") and 
+  
+      /* Suspicious Paths */
+      dll.path : ("?:\\PerfLogs\\*.dll",
+                  "?:\\Users\\*\\Pictures\\*.dll",
+                  "?:\\Users\\*\\Music\\*.dll",
+                  "?:\\Users\\Public\\*.dll",
+                  "?:\\Users\\*\\Documents\\*.dll",
+                  "?:\\Windows\\Tasks\\*.dll",
+                  "?:\\Windows\\System32\\Tasks\\*.dll",
+                  "?:\\Intel\\*.dll",
+                  "?:\\AMD\\Temp\\*.dll",
+                  "?:\\Windows\\AppReadiness\\*.dll",
+                  "?:\\Windows\\ServiceState\\*.dll",
+                  "?:\\Windows\\security\\*.dll",
+		  "?:\\Windows\\System\\*.dll",
+                  "?:\\Windows\\IdentityCRL\\*.dll",
+                  "?:\\Windows\\Branding\\*.dll",
+                  "?:\\Windows\\csc\\*.dll",
+                  "?:\\Windows\\DigitalLocker\\*.dll",
+                  "?:\\Windows\\en-US\\*.dll",
+                  "?:\\Windows\\wlansvc\\*.dll",
+                  "?:\\Windows\\Prefetch\\*.dll",
+                  "?:\\Windows\\Fonts\\*.dll",
+                  "?:\\Windows\\diagnostics\\*.dll",
+                  "?:\\Windows\\TAPI\\*.dll",
+                  "?:\\Windows\\INF\\*.dll",
+                  "?:\\windows\\tracing\\*.dll",
+                  "?:\\windows\\IME\\*.dll",
+                  "?:\\Windows\\Performance\\*.dll",
+                  "?:\\windows\\intel\\*.dll",
+                  "?:\\windows\\ms\\*.dll",
+                  "?:\\Windows\\dot3svc\\*.dll",
+                  "?:\\Windows\\ServiceProfiles\\*.dll",
+                  "?:\\Windows\\panther\\*.dll",
+                  "?:\\Windows\\RemotePackages\\*.dll",
+                  "?:\\Windows\\OCR\\*.dll",
+                  "?:\\Windows\\appcompat\\*.dll",
+                  "?:\\Windows\\apppatch\\*.dll",
+                  "?:\\Windows\\addins\\*.dll",
+                  "?:\\Windows\\Setup\\*.dll",
+                  "?:\\Windows\\Help\\*.dll",
+                  "?:\\Windows\\SKB\\*.dll",
+                  "?:\\Windows\\Vss\\*.dll",
+                  "?:\\Windows\\Web\\*.dll",
+                  "?:\\Windows\\servicing\\*.dll",
+                  "?:\\Windows\\CbsTemp\\*.dll",
+                  "?:\\Windows\\Logs\\*.dll",
+                  "?:\\Windows\\WaaS\\*.dll",
+                  "?:\\Windows\\twain_32\\*.dll",
+                  "?:\\Windows\\ShellExperiences\\*.dll",
+                  "?:\\Windows\\ShellComponents\\*.dll",
+                  "?:\\Windows\\PLA\\*.dll",
+                  "?:\\Windows\\Migration\\*.dll",
+                  "?:\\Windows\\debug\\*.dll",
+                  "?:\\Windows\\Cursors\\*.dll",
+                  "?:\\Windows\\Containers\\*.dll",
+                  "?:\\Windows\\Boot\\*.dll",
+                  "?:\\Windows\\bcastdvr\\*.dll",
+                  "?:\\Windows\\TextInput\\*.dll",
+                  "?:\\Windows\\schemas\\*.dll",
+                  "?:\\Windows\\SchCache\\*.dll",
+                  "?:\\Windows\\Resources\\*.dll",
+                  "?:\\Windows\\rescache\\*.dll",
+                  "?:\\Windows\\Provisioning\\*.dll",
+                  "?:\\Windows\\PrintDialog\\*.dll",
+                  "?:\\Windows\\PolicyDefinitions\\*.dll",
+                  "?:\\Windows\\media\\*.dll",
+                  "?:\\Windows\\Globalization\\*.dll",
+                  "?:\\Windows\\L2Schemas\\*.dll",
+                  "?:\\Windows\\LiveKernelReports\\*.dll",
+                  "?:\\Windows\\ModemLogs\\*.dll",
+                  "?:\\Windows\\ImmersiveControlPanel\\*.dll",
+                  "?:\\$Recycle.Bin\\*.dll") and 
+	 
+	 /* DLL loaded from the process.executable current directory */
+	 endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
+* Technique:
+** Name: Hijack Execution Flow
+** ID: T1574
+** Reference URL: https://attack.mitre.org/techniques/T1574/
+* Sub-technique:
+** Name: DLL Side-Loading
+** ID: T1574.002
+** Reference URL: https://attack.mitre.org/techniques/T1574/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-untrusted-driver-loaded.asciidoc
new file mode 100644
index 0000000000..033c669181
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-untrusted-driver-loaded.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-12-8-untrusted-driver-loaded]]
+=== Untrusted Driver Loaded
+
+Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/hfiref0x/TDL
+* https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Untrusted Driver Loaded*
+
+
+Microsoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. 
+
+This protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.
+
+This rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:
+  - Identify the path that the driver was loaded from. If you're using Elastic Defend, path information can be found in the `dll.path` field.
+  - Examine the file creation and modification timestamps:
+    - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `dll.Ext.relative_file_name_modify_time` fields. The values are in seconds.
+    - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.
+      - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+  - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Use Osquery to investigate the drivers loaded into the system.
+  - !{osquery{"label":"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \"Microsoft\" AND signed == \"1\")\n"}}
+  - !{osquery{"label":"Osquery - Retrieve All Unsigned Drivers with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \"0\"\n"}}
+- Identify the driver's `Device Name` and `Service Name`.
+- Check for alerts from the rules specified in the `Related Rules` section.
+
+
+*False positive analysis*
+
+
+- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.
+
+
+*Related Rules*
+
+
+- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9
+- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd
+- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)
+- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.
+  - This can be done via PowerShell `Remove-Service` cmdlet.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Ensure that the Driver Signature Enforcement is enabled on the system.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+driver where host.os.type == "windows" and process.pid == 4 and
+  dll.code_signature.trusted != true and 
+  not dll.code_signature.status : ("errorExpired", "errorRevoked")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
+* Sub-technique:
+** Name: Invalid Code Signature
+** ID: T1036.001
+** Reference URL: https://attack.mitre.org/techniques/T1036/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process.asciidoc
new file mode 100644
index 0000000000..30f9c12c6f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -0,0 +1,80 @@
+[[prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process]]
+=== Unusual Child Process from a System Virtual Process
+
+Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.pid == 4 and process.executable : "?*" and
+  not process.executable : ("Registry", "MemCompression", "?:\\Windows\\System32\\smss.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe.asciidoc
new file mode 100644
index 0000000000..7cf46ae883
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe.asciidoc
@@ -0,0 +1,136 @@
+[[prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe]]
+=== Unusual Child Process of dns.exe
+
+Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://github.com/maxpl0it/CVE-2020-1350-DoS
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Child Process of dns.exe*
+
+
+SIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can effectively compromise the entire corporate infrastructure.
+
+This rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a similar remote code execution vulnerability in the DNS server.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes.
+  - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).
+  - Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: `mshta.exe`, `powershell.exe`, `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `wmic.exe`.
+  - If a denial-of-service (DoS) exploit is successful and DNS Server service crashes, be mindful of potential child processes related to `werfault.exe` occurring.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the host during the past 48 hours.
+- Check whether the server is vulnerable to CVE-2020-1350.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system or restore the compromised server to a clean state.
+- Install the latest patches on systems that run Microsoft DNS Server.
+- Consider the implementation of a patch management system, such as the Windows Server Update Services (WSUS).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.parent.name : "dns.exe" and
+  not process.name : "conhost.exe"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32.asciidoc
new file mode 100644
index 0000000000..28a0a6c21f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32.asciidoc
@@ -0,0 +1,144 @@
+[[prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32]]
+=== Unusual Child Processes of RunDLL32
+
+Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 30m
+
+*Searches indices from*: now-60m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Child Processes of RunDLL32*
+
+
+By examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.
+
+RunDLL32 is a legitimate Windows utility used to load and execute functions within dynamic-link libraries (DLLs). However, adversaries may abuse RunDLL32 to execute malicious code, bypassing security measures and evading detection. This rule identifies potential abuse by looking for an unusual process creation with no arguments followed by the creation of a child process.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate the behavior of child processes, such as network connections, registry or file modifications, and any spawned processes.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Related Rules*
+
+
+- Unusual Network Connection via RunDLL32 - 52aaab7b-b51c-441a-89ce-4387b3aea886
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence with maxspan=1h
+  [process where host.os.type == "windows" and event.type == "start" and
+     (process.name : "rundll32.exe" or process.pe.original_file_name == "RUNDLL32.EXE") and
+      process.args_count == 1
+  ] by process.entity_id
+  [process where host.os.type == "windows" and event.type == "start" and process.parent.name : "rundll32.exe"
+  ] by process.parent.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
+* Sub-technique:
+** Name: Rundll32
+** ID: T1218.011
+** Reference URL: https://attack.mitre.org/techniques/T1218/011/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process.asciidoc
new file mode 100644
index 0000000000..3dc53b68f5
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -0,0 +1,162 @@
+[[prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process]]
+=== Unusual Executable File Creation by a System Critical Process
+
+Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Executable File Creation by a System Critical Process*
+
+
+Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is file operations.
+
+This rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type != "deletion" and
+  file.extension : ("exe", "dll") and
+  process.name : ("smss.exe",
+                  "autochk.exe",
+                  "csrss.exe",
+                  "wininit.exe",
+                  "services.exe",
+                  "lsass.exe",
+                  "winlogon.exe",
+                  "userinit.exe",
+                  "LogonUI.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Exploitation for Defense Evasion
+** ID: T1211
+** Reference URL: https://attack.mitre.org/techniques/T1211/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Exploitation for Client Execution
+** ID: T1203
+** Reference URL: https://attack.mitre.org/techniques/T1203/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream.asciidoc
new file mode 100644
index 0000000000..3a42276f50
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream.asciidoc
@@ -0,0 +1,212 @@
+[[prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream]]
+=== Unusual File Creation - Alternate Data Stream
+
+Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 114
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual File Creation - Alternate Data Stream*
+
+
+Alternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.
+
+The regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty, contains the data inside the file. So any data stream that has a name is considered an alternate data stream.
+
+Attackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:
+  - `Get-Content C:\Path\To\file.exe -stream SampleAlternateDataStreamName`
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of process executable and file conditions.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+
+  file.path : "C:\\*:*" and
+  not file.path : 
+          ("C:\\*:zone.identifier*",
+           "C:\\users\\*\\appdata\\roaming\\microsoft\\teams\\old_weblogs_*:$DATA") and
+
+  not process.executable :
+          ("?:\\windows\\System32\\svchost.exe",
+           "?:\\Windows\\System32\\inetsrv\\w3wp.exe",
+           "?:\\Windows\\explorer.exe",
+           "?:\\Windows\\System32\\sihost.exe",
+           "?:\\Windows\\System32\\PickerHost.exe",
+           "?:\\Windows\\System32\\SearchProtocolHost.exe",
+           "?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe",
+           "?:\\Program Files\\Rivet Networks\\SmartByte\\SmartByteNetworkService.exe",
+           "?:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
+           "?:\\Program Files\\ExpressConnect\\ExpressConnectNetworkService.exe",
+           "?:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
+           "?:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
+           "?:\\Program Files\\Mozilla Firefox\\firefox.exe",
+           "?:\\Program Files(x86)\\Microsoft Office\\root\\*\\EXCEL.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\EXCEL.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\OUTLOOK.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\POWERPNT.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\POWERPNT.EXE",
+           "?:\\Program Files (x86)\\Microsoft Office\\root\\*\\WINWORD.EXE",
+           "?:\\Program Files\\Microsoft Office\\root\\*\\WINWORD.EXE") and
+
+  file.extension :
+    (
+      "pdf",
+      "dll",
+      "png",
+      "exe",
+      "dat",
+      "com",
+      "bat",
+      "cmd",
+      "sys",
+      "vbs",
+      "ps1",
+      "hta",
+      "txt",
+      "vbe",
+      "js",
+      "wsh",
+      "docx",
+      "doc",
+      "xlsx",
+      "xls",
+      "pptx",
+      "ppt",
+      "rtf",
+      "gif",
+      "jpg",
+      "png",
+      "bmp",
+      "img",
+      "iso"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: NTFS File Attributes
+** ID: T1564.004
+** Reference URL: https://attack.mitre.org/techniques/T1564/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe.asciidoc
new file mode 100644
index 0000000000..4b2d97dddb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe.asciidoc
@@ -0,0 +1,100 @@
+[[prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe]]
+=== Unusual File Modification by dns.exe
+
+Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.file-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
+* https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/
+* https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual File Write*
+
+Detection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:
+- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.
+- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and process.name : "dns.exe" and event.type in ("creation", "deletion", "change") and
+  not file.name : "dns.log" and not
+  (file.extension : ("old", "temp", "bak", "dns", "arpa") and file.path : "C:\\Windows\\System32\\dns\\*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Exploitation of Remote Services
+** ID: T1210
+** Reference URL: https://attack.mitre.org/techniques/T1210/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-child-relationship.asciidoc
new file mode 100644
index 0000000000..dd831d92b2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-child-relationship.asciidoc
@@ -0,0 +1,179 @@
+[[prebuilt-rule-8-12-8-unusual-parent-child-relationship]]
+=== Unusual Parent-Child Relationship
+
+Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png
+* https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Unusual Parent-Child Relationship*
+
+
+Windows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is parent-child relationships. These relationships can be used to baseline the typical behavior of the system and then alert on occurrences that don't comply with the baseline.
+
+This rule uses this information to spot suspicious parent and child processes.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.
+- Examine the host for derived artifacts that indicate suspicious activities:
+  - Analyze the process executable using a private sandboxed analysis system.
+  - Observe and collect information about the following activities in both the sandbox and the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+  - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.
+
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+process.parent.name != null and
+ (
+   /* suspicious parent processes */
+   (process.name:"autochk.exe" and not process.parent.name:"smss.exe") or
+   (process.name:("fontdrvhost.exe", "dwm.exe") and not process.parent.name:("wininit.exe", "winlogon.exe")) or
+   (process.name:("consent.exe", "RuntimeBroker.exe", "TiWorker.exe") and not process.parent.name:"svchost.exe") or
+   (process.name:"SearchIndexer.exe" and not process.parent.name:"services.exe") or
+   (process.name:"SearchProtocolHost.exe" and not process.parent.name:("SearchIndexer.exe", "dllhost.exe")) or
+   (process.name:"dllhost.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
+   (process.name:"smss.exe" and not process.parent.name:("System", "smss.exe")) or
+   (process.name:"csrss.exe" and not process.parent.name:("smss.exe", "svchost.exe")) or
+   (process.name:"wininit.exe" and not process.parent.name:"smss.exe") or
+   (process.name:"winlogon.exe" and not process.parent.name:"smss.exe") or
+   (process.name:("lsass.exe", "LsaIso.exe") and not process.parent.name:"wininit.exe") or
+   (process.name:"LogonUI.exe" and not process.parent.name:("wininit.exe", "winlogon.exe")) or
+   (process.name:"services.exe" and not process.parent.name:"wininit.exe") or
+   (process.name:"svchost.exe" and not process.parent.name:("MsMpEng.exe", "services.exe", "svchost.exe")) or
+   (process.name:"spoolsv.exe" and not process.parent.name:"services.exe") or
+   (process.name:"taskhost.exe" and not process.parent.name:("services.exe", "svchost.exe", "ngentask.exe")) or
+   (process.name:"taskhostw.exe" and not process.parent.name:("services.exe", "svchost.exe")) or
+   (process.name:"userinit.exe" and not process.parent.name:("dwm.exe", "winlogon.exe")) or
+   (process.name:("wmiprvse.exe", "wsmprovhost.exe", "winrshost.exe") and not process.parent.name:"svchost.exe") or
+   /* suspicious child processes */
+   (process.parent.name:("SearchProtocolHost.exe", "taskhost.exe", "csrss.exe") and not process.name:("werfault.exe", "wermgr.exe", "WerFaultSecure.exe", "conhost.exe")) or
+   (process.parent.name:"autochk.exe" and not process.name:("chkdsk.exe", "doskey.exe", "WerFault.exe")) or
+   (process.parent.name:"smss.exe" and not process.name:("autochk.exe", "smss.exe", "csrss.exe", "wininit.exe", "winlogon.exe", "setupcl.exe", "WerFault.exe")) or
+   (process.parent.name:"wermgr.exe" and not process.name:("WerFaultSecure.exe", "wermgr.exe", "WerFault.exe")) or
+   (process.parent.name:"conhost.exe" and not process.name:("mscorsvw.exe", "wermgr.exe", "WerFault.exe", "WerFaultSecure.exe"))
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Sub-technique:
+** Name: Process Hollowing
+** ID: T1055.012
+** Reference URL: https://attack.mitre.org/techniques/T1055/012/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe.asciidoc
new file mode 100644
index 0000000000..dcfbe28cfd
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe.asciidoc
@@ -0,0 +1,104 @@
+[[prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe]]
+=== Unusual Parent Process for cmd.exe
+
+Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : "cmd.exe" and
+  process.parent.name : ("lsass.exe",
+                         "csrss.exe",
+                         "epad.exe",
+                         "regsvr32.exe",
+                         "dllhost.exe",
+                         "LogonUI.exe",
+                         "wermgr.exe",
+                         "spoolsv.exe",
+                         "jucheck.exe",
+                         "jusched.exe",
+                         "ctfmon.exe",
+                         "taskhostw.exe",
+                         "GoogleUpdate.exe",
+                         "sppsvc.exe",
+                         "sihost.exe",
+                         "slui.exe",
+                         "SIHClient.exe",
+                         "SearchIndexer.exe",
+                         "SearchProtocolHost.exe",
+                         "FlashPlayerUpdateService.exe",
+                         "WerFault.exe",
+                         "WUDFHost.exe",
+                         "unsecapp.exe",
+                         "wlanext.exe" ) and
+  not (process.parent.name : "dllhost.exe" and process.parent.args : "/Processid:{CA8C87C1-929D-45BA-94DB-EF8E6CB346AD}")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-persistence-via-services-registry.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-persistence-via-services-registry.asciidoc
new file mode 100644
index 0000000000..9c940ceb83
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-persistence-via-services-registry.asciidoc
@@ -0,0 +1,96 @@
+[[prebuilt-rule-8-12-8-unusual-persistence-via-services-registry]]
+=== Unusual Persistence via Services Registry
+
+Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type == "change" and
+  registry.path : (
+      "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
+      "HKLM\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ServiceDLL",
+      "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet*\\Services\\*\\ImagePath"
+  ) and not registry.data.strings : (
+      "?:\\windows\\system32\\Drivers\\*.sys",
+      "\\SystemRoot\\System32\\drivers\\*.sys",
+      "\\??\\?:\\Windows\\system32\\Drivers\\*.SYS",
+      "system32\\DRIVERS\\USBSTOR") and
+  not (process.name : "procexp??.exe" and registry.data.strings : "?:\\*\\procexp*.sys") and
+  not process.executable : (
+      "?:\\Program Files\\*.exe",
+      "?:\\Program Files (x86)\\*.exe",
+      "?:\\Windows\\System32\\svchost.exe",
+      "?:\\Windows\\winsxs\\*\\TiWorker.exe",
+      "?:\\Windows\\System32\\drvinst.exe",
+      "?:\\Windows\\System32\\services.exe",
+      "?:\\Windows\\System32\\msiexec.exe",
+      "?:\\Windows\\System32\\regsvr32.exe")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Sub-technique:
+** Name: Windows Service
+** ID: T1543.003
+** Reference URL: https://attack.mitre.org/techniques/T1543/003/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc
new file mode 100644
index 0000000000..fc81b0cd02
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc
@@ -0,0 +1,93 @@
+[[prebuilt-rule-8-12-8-unusual-print-spooler-child-process]]
+=== Unusual Print Spooler Child Process
+
+Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Privilege Escalation
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ process.parent.name : "spoolsv.exe" and process.command_line != null and 
+ (?process.Ext.token.integrity_level_name : "System" or ?winlog.event_data.IntegrityLevel : "System") and
+
+ /* exclusions for FP control below */
+ not process.name : ("splwow64.exe", "PDFCreator.exe", "acrodist.exe", "spoolsv.exe", "msiexec.exe", "route.exe", "WerFault.exe") and
+ not process.command_line : "*\\WINDOWS\\system32\\spool\\DRIVERS*" and
+ not (process.name : "net.exe" and process.command_line : ("*stop*", "*start*")) and
+ not (process.name : ("cmd.exe", "powershell.exe") and process.command_line : ("*.spl*", "*\\program files*", "*route add*")) and
+ not (process.name : "netsh.exe" and process.command_line : ("*add portopening*", "*rule name*")) and
+ not (process.name : "regsvr32.exe" and process.command_line : "*PrintConfig.dll*") and
+ not process.executable : (
+    "?:\\Program Files (x86)\\CutePDF Writer\\CPWriter2.exe",
+    "?:\\Program Files (x86)\\GPLGS\\gswin32c.exe"
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Exploitation for Privilege Escalation
+** ID: T1068
+** Reference URL: https://attack.mitre.org/techniques/T1068/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream.asciidoc
new file mode 100644
index 0000000000..0b01e48d9b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream.asciidoc
@@ -0,0 +1,83 @@
+[[prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream]]
+=== Unusual Process Execution Path - Alternate Data Stream
+
+Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.args : "?:\\*:*" and process.args_count == 1
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Hide Artifacts
+** ID: T1564
+** Reference URL: https://attack.mitre.org/techniques/T1564/
+* Sub-technique:
+** Name: NTFS File Attributes
+** ID: T1564.004
+** Reference URL: https://attack.mitre.org/techniques/T1564/004/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host.asciidoc
new file mode 100644
index 0000000000..1a05ad297b
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host]]
+=== Unusual Process Spawned by a Host
+
+A machine learning job has detected a suspicious Windows process. This process has been classified as suspicious in two ways. It was predicted to be suspicious by the ProblemChild supervised ML model, and it was found to be an unusual process, on a host that does not commonly manifest malicious activity. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: If the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and check whether any ProblemChild predictions have been generated.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: System Binary Proxy Execution
+** ID: T1218
+** Reference URL: https://attack.mitre.org/techniques/T1218/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process.asciidoc
new file mode 100644
index 0000000000..6168ea192c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process]]
+=== Unusual Process Spawned by a Parent Process
+
+A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be an unusual child process name, for the parent process, by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user.asciidoc
new file mode 100644
index 0000000000..9cd0251dda
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user]]
+=== Unusual Process Spawned by a User
+
+A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules.
+
+*Rule type*: machine_learning
+
+*Rule indices*: None
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 15m
+
+*Searches indices from*: now-45m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html
+* https://docs.elastic.co/en/integrations/problemchild
+* https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Living off the Land Attack Detection
+* Rule Type: ML
+* Rule Type: Machine Learning
+* Tactic: Defense Evasion
+
+*Version*: 4
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The rule requires the Living off the Land (LotL) Attack Detection integration assets to be installed, as well as Windows process events collected by integrations such as Elastic Defend or Winlogbeat.  
+
+
+*LotL Attack Detection Setup*
+
+The LotL Attack Detection integration detects living-off-the-land activity in Windows process events.
+
+
+*Prerequisite Requirements:*
+
+- Fleet is required for LotL Attack Detection.
+- To configure Fleet Server refer to the https://www.elastic.co/guide/en/fleet/current/fleet-server.html[documentation].
+- Windows process events collected by the https://docs.elastic.co/en/integrations/endpoint[Elastic Defend] integration or Winlogbeat(https://www.elastic.co/guide/en/beats/winlogbeat/current/_winlogbeat_overview.html).
+- To install Elastic Defend, refer to the https://www.elastic.co/guide/en/security/current/install-endpoint.html[documentation].
+- To set up and run Winlogbeat, follow https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-installation-configuration.html[this] guide.
+
+
+*The following steps should be executed to install assets associated with the LotL Attack Detection integration:*
+
+- Go to the Kibana homepage. Under Management, click Integrations.
+- In the query bar, search for Living off the Land Attack Detection and select the integration to see more details about it.
+- Under Settings, click Install Living off the Land Attack Detection assets and follow the prompts to install the assets.
+
+
+*Ingest Pipeline Setup*
+
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+- If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
+
+
+*Adding Custom Mappings*
+
+- Go to the Kibana homepage. Under Management, click Stack Management.
+- Under Data click Index Management and navigate to the Component Templates tab.
+- Templates that can be edited to add custom components will be marked with a @custom suffix. Edit the @custom component template corresponding to the beat/integration you added the LotL ingest pipeline to, by pasting the following JSON blob in the "Load JSON" flyout:
+```
+{
+  "properties": {
+    "problemchild": {
+      "properties": {
+        "prediction": {
+          "type": "long"
+        },
+        "prediction_probability": {
+          "type": "float"
+        }
+      }
+    },
+    "blocklist_label": {
+      "type": "long"
+    }
+  }
+}
+```
+
+
+*Anomaly Detection Setup*
+
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
+- Go to the Kibana homepage. Under Analytics, click Machine Learning.
+- Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
+- Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
+
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Masquerading
+** ID: T1036
+** Reference URL: https://attack.mitre.org/techniques/T1036/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc
new file mode 100644
index 0000000000..07a32c8699
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc
@@ -0,0 +1,120 @@
+[[prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service]]
+=== Unusual Service Host Child Process - Childless Service
+
+Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Privilege Escalation
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "svchost.exe" and
+
+  /* based on svchost service arguments -s svcname where the service is known to be childless */
+  process.parent.args : (
+    "WdiSystemHost", "LicenseManager", "StorSvc", "CDPSvc", "cdbhsvc", "BthAvctpSvc", "SstpSvc", "WdiServiceHost",
+    "imgsvc", "TrkWks", "WpnService", "IKEEXT", "PolicyAgent", "CryptSvc", "netprofm", "ProfSvc", "StateRepository",
+    "camsvc", "LanmanWorkstation", "NlaSvc", "EventLog", "hidserv", "DisplayEnhancementService", "ShellHWDetection",
+    "AppHostSvc", "fhsvc", "CscService", "PushToInstall"
+  ) and
+
+  /* unknown FPs can be added here */
+  not process.name : ("WerFault.exe", "WerFaultSecure.exe", "wermgr.exe") and
+  not (process.executable : "?:\\Windows\\System32\\RelPost.exe" and process.parent.args : "WdiSystemHost") and
+  not (
+    process.name : "rundll32.exe" and
+    process.args : "?:\\WINDOWS\\System32\\winethc.dll,ForceProxyDetectionOnNextRun" and
+    process.parent.args : "WdiServiceHost"
+  ) and
+  not (
+    process.executable : (
+      "?:\\Program Files\\*",
+      "?:\\Program Files (x86)\\*",
+      "?:\\Windows\\System32\\Kodak\\kds_?????\\lib\\lexexe.exe"
+    ) and process.parent.args : "imgsvc"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Privilege Escalation
+** ID: TA0004
+** Reference URL: https://attack.mitre.org/tactics/TA0004/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Sub-technique:
+** Name: Process Hollowing
+** ID: T1055.012
+** Reference URL: https://attack.mitre.org/techniques/T1055/012/
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Process Injection
+** ID: T1055
+** Reference URL: https://attack.mitre.org/techniques/T1055/
+* Sub-technique:
+** Name: Process Hollowing
+** ID: T1055.012
+** Reference URL: https://attack.mitre.org/techniques/T1055/012/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-user-account-creation.asciidoc
new file mode 100644
index 0000000000..b7bd128321
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-user-account-creation.asciidoc
@@ -0,0 +1,135 @@
+[[prebuilt-rule-8-12-8-user-account-creation]]
+=== User Account Creation
+
+Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 109
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating User Account Creation*
+
+
+Attackers may create new accounts (both local and domain) to maintain access to victim systems.
+
+This rule identifies the usage of `net.exe` to create new accounts.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Identify if the account was added to privileged groups or assigned special privileges after creation.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.
+
+
+*Related rules*
+
+
+- Creation of a Hidden Local User Account - 2edc8076-291e-41e9-81e4-e3fcbc97ae5e
+- Windows User Account Creation - 38e17753-f581-4644-84da-0d60a8318694
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Delete the created account.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("net.exe", "net1.exe") and
+  not process.parent.name : "net.exe" and
+  (process.args : "user" and process.args : ("/ad", "/add"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create Account
+** ID: T1136
+** Reference URL: https://attack.mitre.org/techniques/T1136/
+* Sub-technique:
+** Name: Local Account
+** ID: T1136.001
+** Reference URL: https://attack.mitre.org/techniques/T1136/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process.asciidoc
new file mode 100644
index 0000000000..beb5fe597f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process.asciidoc
@@ -0,0 +1,81 @@
+[[prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process]]
+=== Veeam Backup Library Loaded by Unusual Process
+
+Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.library-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Elastic Defend
+
+*Version*: 2
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+library where host.os.type == "windows" and event.action == "load" and
+  (dll.name : "Veeam.Backup.Common.dll" or dll.pe.original_file_name : "Veeam.Backup.Common.dll") and
+  (
+    process.code_signature.trusted == false or
+    process.code_signature.exists == false or
+    process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
new file mode 100644
index 0000000000..16738230b3
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
@@ -0,0 +1,154 @@
+[[prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin]]
+=== Volume Shadow Copy Deleted or Resized via VssAdmin
+
+Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deleted or Resized via VssAdmin*
+
+
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
+
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
+
+This rule monitors the execution of Vssadmin.exe to either delete or resize shadow copies.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences in other hosts.
+- Check if any files on the host machine have been encrypted.
+
+
+
+*False positive analysis*
+
+
+- This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Related rules*
+
+
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Priority should be given due to the advanced stage of this activity on the attack.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- If data was encrypted, deleted, or modified, activate your data recovery plan.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start"
+  and (process.name : "vssadmin.exe" or ?process.pe.original_file_name == "VSSADMIN.EXE") and
+  process.args in ("delete", "resize") and process.args : "shadows*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell.asciidoc
new file mode 100644
index 0000000000..0420e9bd5a
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell.asciidoc
@@ -0,0 +1,173 @@
+[[prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell]]
+=== Volume Shadow Copy Deletion via PowerShell
+
+Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy
+* https://powershell.one/wmi/root/cimv2/win32_shadowcopy
+* https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deletion via PowerShell*
+
+
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
+
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
+
+This rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow copy objects, and delete them.
+
+
+*Possible investigation steps*
+
+
+- Investigate the program execution chain (parent process tree).
+- Check whether the account is authorized to perform this operation.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences in other hosts.
+- Check if any files on the host machine have been encrypted.
+
+
+
+*False positive analysis*
+
+
+- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Related rules*
+
+
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- Priority should be given due to the advanced stage of this activity on the attack.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- If data was encrypted, deleted, or modified, activate your data recovery plan.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and
+  process.args : ("*Get-WmiObject*", "*gwmi*", "*Get-CimInstance*", "*gcim*") and
+  process.args : ("*Win32_ShadowCopy*") and
+  process.args : ("*.Delete()*", "*Remove-WmiObject*", "*rwmi*", "*Remove-CimInstance*", "*rcim*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic.asciidoc
new file mode 100644
index 0000000000..94b7296d32
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic.asciidoc
@@ -0,0 +1,163 @@
+[[prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic]]
+=== Volume Shadow Copy Deletion via WMIC
+
+Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Impact
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Volume Shadow Copy Deletion via WMIC*
+
+
+The Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.
+
+A typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.
+
+This rule monitors the execution of `wmic.exe` to interact with VSS via the `shadowcopy` alias and delete parameter.
+
+
+*Possible investigation steps*
+
+
+- Investigate the program execution chain (parent process tree).
+- Check whether the account is authorized to perform this operation.
+- Contact the account owner and confirm whether they are aware of this activity.
+- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Use process name, command line, and file hash to search for occurrences in other hosts.
+- Check if any files on the host machine have been encrypted.
+
+
+
+*False positive analysis*
+
+
+- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination of user and command line conditions.
+
+
+*Related rules*
+
+
+- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921
+- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Priority should be given due to the advanced stage of this activity on the attack.
+- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- If data was encrypted, deleted, or modified, activate your data recovery plan.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  (process.name : "WMIC.exe" or ?process.pe.original_file_name == "wmic.exe") and
+  process.args : "delete" and process.args : "shadowcopy"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Impact
+** ID: TA0040
+** Reference URL: https://attack.mitre.org/tactics/TA0040/
+* Technique:
+** Name: Inhibit System Recovery
+** ID: T1490
+** Reference URL: https://attack.mitre.org/techniques/T1490/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
new file mode 100644
index 0000000000..d3496abecb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -0,0 +1,190 @@
+[[prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes]]
+=== Web Shell Detection: Script Process Child of Common Web Processes
+
+Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
+* https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965
+* https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Persistence
+* Tactic: Initial Access
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Web Shell Detection: Script Process Child of Common Web Processes*
+
+
+Adversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the web server.
+
+This rule detects a web server process spawning script and command-line interface programs, potentially indicating attackers executing commands using the web shell.
+
+
+*Possible investigation steps*
+
+
+- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any other spawned child processes.
+- Examine the command line to determine which commands or scripts were executed.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- If scripts or executables were dropped, retrieve the files and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("w3wp.exe", "httpd.exe", "nginx.exe", "php.exe", "php-cgi.exe", "tomcat.exe") and
+  process.name : ("cmd.exe", "cscript.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "wmic.exe", "wscript.exe") and
+  not 
+  (
+    process.parent.name : ("php.exe", "httpd.exe") and process.name : "cmd.exe" and
+    process.command_line : (
+      "cmd.exe /c mode CON",
+      "cmd.exe /s /c \"mode CON\"",
+      "cmd.exe /c \"mode\"",
+      "cmd.exe /s /c \"tput colors 2>&1\""
+    )
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Server Software Component
+** ID: T1505
+** Reference URL: https://attack.mitre.org/techniques/T1505/
+* Sub-technique:
+** Name: Web Shell
+** ID: T1505.003
+** Reference URL: https://attack.mitre.org/techniques/T1505/003/
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
+* Technique:
+** Name: Windows Management Instrumentation
+** ID: T1047
+** Reference URL: https://attack.mitre.org/techniques/T1047/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-whoami-process-activity.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-whoami-process-activity.asciidoc
new file mode 100644
index 0000000000..0f5e714729
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-whoami-process-activity.asciidoc
@@ -0,0 +1,152 @@
+[[prebuilt-rule-8-12-8-whoami-process-activity]]
+=== Whoami Process Activity
+
+Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* logs-system.*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Whoami Process Activity*
+
+
+After successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.
+
+This rule looks for the execution of the `whoami` utility. Attackers commonly use this utility to measure their current privileges, discover the current user, determine if a privilege escalation was successful, etc.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.
+
+
+*False positive analysis*
+
+
+- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.
+
+
+*Related rules*
+
+
+- Account Discovery Command via SYSTEM Account - 2856446a-34e6-435b-9fb5-f8f040bfa7ed
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and process.name : "whoami.exe" and
+(
+  (
+    /* scoped for whoami execution under system privileges */
+    (
+      user.domain : ("NT *", "* NT", "IIS APPPOOL") and
+      user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20", "S-1-5-82-*") and
+      not ?winlog.event_data.SubjectUserName : "*$"
+    ) and
+    not (
+      process.parent.name : "cmd.exe" and
+      process.parent.args : (
+          "chcp 437>nul 2>&1 & C:\\WINDOWS\\System32\\whoami.exe  /groups",
+          "chcp 437>nul 2>&1 & %systemroot%\\system32\\whoami /user",
+          "C:\\WINDOWS\\System32\\whoami.exe /groups",
+          "*WINDOWS\\system32\\config\\systemprofile*"
+      )
+    ) and
+    not (process.parent.executable : "C:\\Windows\\system32\\inetsrv\\appcmd.exe" and process.parent.args : "LIST") and
+    not process.parent.executable : (
+        "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe",
+        "C:\\Program Files\\Cohesity\\cohesity_windows_agent_service.exe"
+    )
+  ) or
+  process.parent.name : ("wsmprovhost.exe", "w3wp.exe", "wmiprvse.exe", "rundll32.exe", "regsvr32.exe")
+)
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Owner/User Discovery
+** ID: T1033
+** Reference URL: https://attack.mitre.org/techniques/T1033/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification.asciidoc
new file mode 100644
index 0000000000..57055c96dc
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification]]
+=== Windows Defender Disabled via Registry Modification
+
+Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.registry-*
+* endgame-*
+* logs-windows.sysmon_operational-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://thedfirreport.com/2020/12/13/defender-control/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Defender Disabled via Registry Modification*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.
+
+This rule monitors the registry for configurations that disable Windows Defender or the start of its service.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Check if this operation was approved and performed according to the organization's change management policy.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.
+
+
+*Related rules*
+
+
+- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
+- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Re-enable Windows Defender and restore the service configurations to automatic start.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and event.type in ("creation", "change") and
+  (
+    (
+      registry.path: (
+        "HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
+        "\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware"
+      ) and
+      registry.data.strings: ("1", "0x00000001")
+   ) or
+   (
+      registry.path: (
+        "HKLM\\System\\*ControlSet*\\Services\\WinDefend\\Start",
+        "\\REGISTRY\\MACHINE\\System\\*ControlSet*\\Services\\WinDefend\\Start"
+      ) and
+      registry.data.strings in ("3", "4", "0x00000003", "0x00000004")
+   )
+  ) and
+
+  not
+    (
+      process.executable : (
+          "?:\\WINDOWS\\system32\\services.exe",
+          "?:\\Windows\\System32\\svchost.exe",
+          "?:\\Program Files (x86)\\Trend Micro\\Security Agent\\NTRmv.exe"
+      ) and user.id : "S-1-5-18"
+    )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell.asciidoc
new file mode 100644
index 0000000000..4e01b29a76
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell.asciidoc
@@ -0,0 +1,167 @@
+[[prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell]]
+=== Windows Defender Exclusions Added via PowerShell
+
+Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Defender Exclusions Added via PowerShell*
+
+
+Microsoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/[examples] was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Examine the exclusion in order to determine the intent behind it.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+- If the exclusion specifies a suspicious file or path, retrieve the file(s) and determine if malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+
+
+*False positive analysis*
+
+
+- This rule has a high chance to produce false positives due to how often network administrators legitimately configure exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many legitimate reasons for exclusions, so it's important to gain context.
+
+
+*Related rules*
+
+
+- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb
+- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Exclusion lists for antimalware capabilities should always be routinely monitored for review.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name in ("powershell.exe", "pwsh.dll", "powershell_ise.exe")) and
+  process.args : ("*Add-MpPreference*", "*Set-MpPreference*") and
+  process.args : ("*-Exclusion*")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify Tools
+** ID: T1562.001
+** Reference URL: https://attack.mitre.org/techniques/T1562/001/
+* Sub-technique:
+** Name: Indicator Blocking
+** ID: T1562.006
+** Reference URL: https://attack.mitre.org/techniques/T1562/006/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell.asciidoc
new file mode 100644
index 0000000000..07cf29236e
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell.asciidoc
@@ -0,0 +1,151 @@
+[[prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell]]
+=== Windows Firewall Disabled via PowerShell
+
+Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps
+* https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
+* http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
+* http://woshub.com/manage-windows-firewall-powershell/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 110
+
+*Rule authors*: 
+
+* Austin Songer
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Firewall Disabled via PowerShell*
+
+
+Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.
+
+Attackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.
+
+This rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe.
+
+
+*False positive analysis*
+
+
+- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.
+- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Re-enable the firewall with its desired configurations.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.action == "start" and
+  (process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") or ?process.pe.original_file_name == "PowerShell.EXE") and
+   process.args : "*Set-NetFirewallProfile*" and
+  (process.args : "*-Enabled*" and process.args : "*False*") and
+  (process.args : "*-All*" or process.args : ("*Public*", "*Domain*", "*Private*"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Impair Defenses
+** ID: T1562
+** Reference URL: https://attack.mitre.org/techniques/T1562/
+* Sub-technique:
+** Name: Disable or Modify System Firewall
+** ID: T1562.004
+** Reference URL: https://attack.mitre.org/techniques/T1562/004/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share.asciidoc
new file mode 100644
index 0000000000..002634e9b0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share]]
+=== Windows Registry File Creation in SMB Share
+
+Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.file-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.elastic.co/security-labs/detect-credential-access
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Lateral Movement
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 108
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Registry File Creation in SMB Share*
+
+
+Dumping registry hives is a common way to access credential information. Some hives store credential material, as is the case for the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.
+
+Attackers can try to evade detection on the host by transferring this data to a system that is not monitored to be parsed and decrypted. This rule identifies the creation or modification of a medium-size registry hive file on an SMB share, which may indicate this kind of exfiltration attempt.
+
+
+*Possible investigation steps*
+
+
+- Investigate other alerts associated with the user/source host during the past 48 hours.
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Inspect the source host for suspicious or abnormal behaviors in the alert timeframe.
+- Capture the registry file(s) to determine the extent of the credential compromise in an eventual incident response.
+
+
+*False positive analysis*
+
+
+- Administrators can export registry hives for backup purposes. Check whether the user should be performing this kind of activity and is aware of it.
+
+
+*Related rules*
+
+
+- Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved hosts to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+file where host.os.type == "windows" and event.type == "creation" and
+ /* regf file header */
+ file.Ext.header_bytes : "72656766*" and file.size >= 30000 and
+ process.pid == 4 and user.id : ("S-1-5-21*", "S-1-12-1-*") and
+ not file.path : (
+    "?:\\*\\UPM_Profile\\NTUSER.DAT",
+    "?:\\*\\UPM_Profile\\NTUSER.DAT.LASTGOOD.LOAD",
+    "?:\\Windows\\Netwrix\\Temp\\????????.???.offreg",
+    "?:\\*\\AppData\\Local\\Packages\\Microsoft.*\\Settings\\settings.dat*"
+ )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Sub-technique:
+** Name: Security Account Manager
+** ID: T1003.002
+** Reference URL: https://attack.mitre.org/techniques/T1003/002/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SMB/Windows Admin Shares
+** ID: T1021.002
+** Reference URL: https://attack.mitre.org/techniques/T1021/002/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-script-executing-powershell.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-script-executing-powershell.asciidoc
new file mode 100644
index 0000000000..75919e72e6
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-script-executing-powershell.asciidoc
@@ -0,0 +1,170 @@
+[[prebuilt-rule-8-12-8-windows-script-executing-powershell]]
+=== Windows Script Executing PowerShell
+
+Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 111
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Script Executing PowerShell*
+
+
+The Windows Script Host (WSH) is an Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.
+
+Attackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but can also use them to download tools and utilities needed to accomplish their goals.
+
+This rule looks for the spawn of the `powershell.exe` process with `cscript.exe` or `wscript.exe` as its parent process.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate commands executed by the spawned PowerShell process.
+- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:
+  - Use a private sandboxed malware analysis system to perform analysis.
+    - Observe and collect information about the following activities:
+      - Attempts to contact external domains and addresses.
+      - File and registry access, modification, and creation activities.
+      - Service creation and launch activities.
+      - Scheduled task creation.
+  - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.
+    - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.
+- Determine how the script file was delivered (email attachment, dropped by other processes, etc.).
+- Investigate other alerts associated with the user/host during the past 48 hours.
+
+
+*False positive analysis*
+
+
+- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- If the triage identified malware, search the environment for additional compromised hosts.
+  - Implement temporary network rules, procedures, and segmentation to contain the malware.
+  - Stop suspicious processes.
+  - Immediately block the identified indicators of compromise (IoCs).
+  - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
+- Remove and block malicious artifacts identified during triage.
+- If the malicious file was delivered via phishing:
+  - Block the email sender from sending future emails.
+  - Block the malicious web pages.
+  - Remove emails from the sender from mailboxes.
+  - Consider improvements to the security awareness program.
+- Reimage the host operating system and restore compromised files to clean versions.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions <8.2,
+events will not define `event.ingested` and default fallback for EQL rules was not added until version 8.2.
+Hence for this rule to work effectively, users will need to add a custom ingest pipeline to populate
+`event.ingested` to @timestamp.
+For more details on adding a custom ingest pipeline refer - https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : ("cscript.exe", "wscript.exe") and process.name : "powershell.exe" and
+  not (
+    process.parent.name : "wscript.exe" and
+    process.parent.args : "?:\\ProgramData\\intune-drive-mapping-generator\\IntuneDriveMapping-VBSHelper.vbs" and
+    process.parent.args : "?:\\ProgramData\\intune-drive-mapping-generator\\DriveMapping.ps1"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Phishing
+** ID: T1566
+** Reference URL: https://attack.mitre.org/techniques/T1566/
+* Sub-technique:
+** Name: Spearphishing Attachment
+** ID: T1566.001
+** Reference URL: https://attack.mitre.org/techniques/T1566/001/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Visual Basic
+** ID: T1059.005
+** Reference URL: https://attack.mitre.org/techniques/T1059/005/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed.asciidoc
new file mode 100644
index 0000000000..5082c8d5f0
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed.asciidoc
@@ -0,0 +1,126 @@
+[[prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed]]
+=== Windows Subsystem for Linux Distribution Installed
+
+Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.registry-*
+* logs-windows.sysmon_operational-*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows/wsl/wsl-config
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Subsystem for Linux Distribution Installed*
+
+
+The Windows Subsystem for Linux (WSL) lets developers install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup. Attackers may abuse WSL to avoid security protections on a Windows host and perform a wide range of attacks.
+
+This rule identifies the installation of a new Windows Subsystem for Linux distribution via registry events.
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Examine which distribution was installed. Some distributions such as Kali Linux can facilitate the compromise of the environment.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate that the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and the WSL distribution is homologated and approved in the environment.
+
+
+*Related Rules*
+
+
+- Host Files System Changes via Windows Subsystem for Linux - e88d1fe9-b2f4-48d4-bace-a026dc745d4b
+- Execution via Windows Subsystem for Linux - db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd
+- Suspicious Execution via Windows Subsystem for Linux - 3e0eeb75-16e8-4f2f-9826-62461ca128b7
+- Windows Subsystem for Linux Enabled via Dism Utility - e2e0537d-7d8f-4910-a11d-559bcf61295a
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+registry where host.os.type == "windows" and
+ registry.path : 
+       ("HK*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\*\\PackageFamilyName",
+        "\\REGISTRY\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Lxss\\*\\PackageFamilyName")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Modify Registry
+** ID: T1112
+** Reference URL: https://attack.mitre.org/techniques/T1112/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
new file mode 100644
index 0000000000..1bd761d684
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
@@ -0,0 +1,120 @@
+[[prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility]]
+=== Windows Subsystem for Linux Enabled via Dism Utility
+
+Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Defense Evasion
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+
+*Version*: 7
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Windows Subsystem for Linux Enabled via Dism Utility*
+
+
+The Windows Subsystem for Linux (WSL) lets developers install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup. Attackers may abuse WSL to avoid security protections on a Windows host and perform a wide range of attacks.
+
+This rule identifies attempts to enable WSL using the Dism utility. It monitors for the execution of Dism and checks if the command line contains the string "Microsoft-Windows-Subsystem-Linux". 
+
+
+*Possible investigation steps*
+
+
+- Identify the user account that performed the action and whether it should perform this kind of action.
+- Contact the account owner and confirm whether they are aware of this activity.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.
+- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.
+
+
+*False positive analysis*
+
+
+- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and WSL is homologated and approved in the environment.
+
+
+*Related Rules*
+
+
+- Execution via Windows Subsystem for Linux - db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd
+- Suspicious Execution via Windows Subsystem for Linux - 3e0eeb75-16e8-4f2f-9826-62461ca128b7
+- Host Files System Changes via Windows Subsystem for Linux - e88d1fe9-b2f4-48d4-bace-a026dc745d4b
+- Windows Subsystem for Linux Distribution Installed - a1699af0-8e1e-4ed0-8ec1-89783538a061
+
+
+*Response and Remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type : "start" and
+ (process.name : "Dism.exe" or ?process.pe.original_file_name == "DISM.EXE") and 
+ process.command_line : "*Microsoft-Windows-Subsystem-Linux*"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Defense Evasion
+** ID: TA0005
+** Reference URL: https://attack.mitre.org/tactics/TA0005/
+* Technique:
+** Name: Indirect Command Execution
+** ID: T1202
+** Reference URL: https://attack.mitre.org/techniques/T1202/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command.asciidoc
new file mode 100644
index 0000000000..20764336d7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command.asciidoc
@@ -0,0 +1,138 @@
+[[prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command]]
+=== Wireless Credential Dumping using Netsh Command
+
+Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-endpoint.events.process-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
+* https://www.geeksforgeeks.org/how-to-find-the-wi-fi-password-using-cmd-in-windows/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Discovery
+* Data Source: Elastic Endgame
+* Resources: Investigation Guide
+* Data Source: Elastic Defend
+
+*Version*: 8
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Investigation guide
+
+
+
+*Triage and analysis*
+
+
+
+*Investigating Wireless Credential Dumping using Netsh Command*
+
+
+Netsh is a Windows command line tool used for network configuration and troubleshooting. It enables the management of network settings and adapters, wireless network profiles, and other network-related tasks.
+
+This rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.
+
+> **Note**:
+> This investigation guide uses the https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html[Osquery Markdown Plugin] introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.
+
+
+*Possible investigation steps*
+
+
+- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
+- Investigate other alerts associated with the user/host during the past 48 hours.
+- Inspect the host for suspicious or abnormal behavior in the alert timeframe:
+  - Observe and collect information about the following activities in the alert subject host:
+    - Attempts to contact external domains and addresses.
+      - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.
+      - Examine the DNS cache for suspicious or anomalous entries.
+        - !{osquery{"label":"Osquery - Retrieve DNS Cache","query":"SELECT * FROM dns_cache"}}
+    - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.
+    - Examine the host services for suspicious or anomalous entries.
+      - !{osquery{"label":"Osquery - Retrieve All Services","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services"}}
+      - !{osquery{"label":"Osquery - Retrieve Services Running on User Accounts","query":"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\nuser_account == null)\n"}}
+      - !{osquery{"label":"Osquery - Retrieve Service Unsigned Executables with Virustotal Link","query":"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\n"}}
+
+
+*False positive analysis*
+
+
+- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.
+
+
+*Response and remediation*
+
+
+- Initiate the incident response process based on the outcome of the triage.
+- Isolate the involved host to prevent further post-compromise behavior.
+- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
+- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
+- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
+- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
+- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+ (process.name : "netsh.exe" or ?process.pe.original_file_name == "netsh.exe") and
+  process.args : "wlan" and process.args : "key*clear"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: OS Credential Dumping
+** ID: T1003
+** Reference URL: https://attack.mitre.org/techniques/T1003/
+* Technique:
+** Name: Credentials from Password Stores
+** ID: T1555
+** Reference URL: https://attack.mitre.org/techniques/T1555/
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: System Information Discovery
+** ID: T1082
+** Reference URL: https://attack.mitre.org/techniques/T1082/
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
new file mode 100644
index 0000000000..8df579d4fa
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
@@ -0,0 +1,253 @@
+["appendix",role="exclude",id="prebuilt-rule-8-12-8-prebuilt-rules-8-12-8-appendix"]
+= Downloadable rule update v8.12.8
+
+This section lists all updates associated with version 8.12.8 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+include::prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-creation-of-a-dns-named-record.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user.asciidoc[]
+include::prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc[]
+include::prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook.asciidoc[]
+include::prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc[]
+include::prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-file-transfer-via-certreq.asciidoc[]
+include::prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup.asciidoc[]
+include::prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc[]
+include::prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits.asciidoc[]
+include::prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc[]
+include::prebuilt-rule-8-12-8-port-forwarding-rule-addition.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected.asciidoc[]
+include::prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility.asciidoc[]
+include::prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun.asciidoc[]
+include::prebuilt-rule-8-12-8-sunburst-command-and-control-activity.asciidoc[]
+include::prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities.asciidoc[]
+include::prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied.asciidoc[]
+include::prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc[]
+include::prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping.asciidoc[]
+include::prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption.asciidoc[]
+include::prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process.asciidoc[]
+include::prebuilt-rule-8-12-8-kirbi-file-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass.asciidoc[]
+include::prebuilt-rule-8-12-8-lsass-memory-dump-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-lsass-process-access-via-windows-api.asciidoc[]
+include::prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected.asciidoc[]
+include::prebuilt-rule-8-12-8-modification-of-wdigest-security-provider.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share.asciidoc[]
+include::prebuilt-rule-8-12-8-network-logon-provider-registry-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd.asciidoc[]
+include::prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created.asciidoc[]
+include::prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process.asciidoc[]
+include::prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command.asciidoc[]
+include::prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll.asciidoc[]
+include::prebuilt-rule-8-12-8-modification-of-amsienable-registry-key.asciidoc[]
+include::prebuilt-rule-8-12-8-clearing-windows-console-history.asciidoc[]
+include::prebuilt-rule-8-12-8-clearing-windows-event-logs.asciidoc[]
+include::prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools.asciidoc[]
+include::prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil.asciidoc[]
+include::prebuilt-rule-8-12-8-powershell-script-block-logging-disabled.asciidoc[]
+include::prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh.asciidoc[]
+include::prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[]
+include::prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-net-code-compilation.asciidoc[]
+include::prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc[]
+include::prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh.asciidoc[]
+include::prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments.asciidoc[]
+include::prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc[]
+include::prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions.asciidoc[]
+include::prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory.asciidoc[]
+include::prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-iis-http-logging-disabled.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps.asciidoc[]
+include::prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-werfault-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-program-files-directory-masquerading.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-windows-defender-tampering.asciidoc[]
+include::prebuilt-rule-8-12-8-parent-process-pid-spoofing.asciidoc[]
+include::prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32.asciidoc[]
+include::prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility.asciidoc[]
+include::prebuilt-rule-8-12-8-sip-provider-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-certutil-commands.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device.asciidoc[]
+include::prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-zoom-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process.asciidoc[]
+include::prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc[]
+include::prebuilt-rule-8-12-8-untrusted-driver-loaded.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-evasion-via-filter-manager.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc[]
+include::prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed.asciidoc[]
+include::prebuilt-rule-8-12-8-adfind-command-activity.asciidoc[]
+include::prebuilt-rule-8-12-8-enumeration-of-administrator-accounts.asciidoc[]
+include::prebuilt-rule-8-12-8-account-discovery-command-via-system-account.asciidoc[]
+include::prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe.asciidoc[]
+include::prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe.asciidoc[]
+include::prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility.asciidoc[]
+include::prebuilt-rule-8-12-8-peripheral-device-discovery.asciidoc[]
+include::prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions.asciidoc[]
+include::prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership.asciidoc[]
+include::prebuilt-rule-8-12-8-whoami-process-activity.asciidoc[]
+include::prebuilt-rule-8-12-8-command-execution-via-solarwinds-process.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-solarwinds-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard.asciidoc[]
+include::prebuilt-rule-8-12-8-svchost-spawning-cmd.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe.asciidoc[]
+include::prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32.asciidoc[]
+include::prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names.asciidoc[]
+include::prebuilt-rule-8-12-8-powershell-psreflect-script.asciidoc[]
+include::prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable.asciidoc[]
+include::prebuilt-rule-8-12-8-process-activity-via-compiled-html-file.asciidoc[]
+include::prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process.asciidoc[]
+include::prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet.asciidoc[]
+include::prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process.asciidoc[]
+include::prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin.asciidoc[]
+include::prebuilt-rule-8-12-8-modification-of-boot-configuration.asciidoc[]
+include::prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations.asciidoc[]
+include::prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc[]
+include::prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins.asciidoc[]
+include::prebuilt-rule-8-12-8-first-time-seen-removable-device.asciidoc[]
+include::prebuilt-rule-8-12-8-windows-script-executing-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc[]
+include::prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-ms-office-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-explorer-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-nullsessionpipe-registry-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint.asciidoc[]
+include::prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares.asciidoc[]
+include::prebuilt-rule-8-12-8-rdp-enabled-via-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share.asciidoc[]
+include::prebuilt-rule-8-12-8-remotely-started-services-via-rpc.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe.asciidoc[]
+include::prebuilt-rule-8-12-8-lateral-movement-via-startup-folder.asciidoc[]
+include::prebuilt-rule-8-12-8-adobe-hijack-persistence.asciidoc[]
+include::prebuilt-rule-8-12-8-installation-of-custom-shim-databases.asciidoc[]
+include::prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll.asciidoc[]
+include::prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll.asciidoc[]
+include::prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account.asciidoc[]
+include::prebuilt-rule-8-12-8-image-file-execution-options-injection.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-local-scheduled-task-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba.asciidoc[]
+include::prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-powershell-profile.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries.asciidoc[]
+include::prebuilt-rule-8-12-8-uncommon-registry-persistence-change.asciidoc[]
+include::prebuilt-rule-8-12-8-startup-or-run-key-registry-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program.asciidoc[]
+include::prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-persistence-via-services-registry.asciidoc[]
+include::prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process.asciidoc[]
+include::prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory.asciidoc[]
+include::prebuilt-rule-8-12-8-component-object-model-hijacking.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-imagepath-service-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-system-shells-via-services.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-user-account-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected.asciidoc[]
+include::prebuilt-rule-8-12-8-installation-of-security-support-provider.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription.asciidoc[]
+include::prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider.asciidoc[]
+include::prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc[]
+include::prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes.asciidoc[]
+include::prebuilt-rule-8-12-8-process-created-with-a-duplicated-token.asciidoc[]
+include::prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification.asciidoc[]
+include::prebuilt-rule-8-12-8-first-time-seen-driver-loaded.asciidoc[]
+include::prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded.asciidoc[]
+include::prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse.asciidoc[]
+include::prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc[]
+include::prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion.asciidoc[]
+include::prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created.asciidoc[]
+include::prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable.asciidoc[]
+include::prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc[]
+include::prebuilt-rule-8-12-8-bypass-uac-via-event-viewer.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading.asciidoc[]
+include::prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-parent-child-relationship.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc[]
+include::prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc[]
+include::prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc[]
+include::prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc[]
+include::prebuilt-rule-8-12-8-deprecated-remote-file-creation-on-a-sensitive-directory.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
new file mode 100644
index 0000000000..c3bfec82fb
--- /dev/null
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
@@ -0,0 +1,506 @@
+[[prebuilt-rule-8-12-8-prebuilt-rules-8-12-8-summary]]
+[role="xpack"]
+== Update v8.12.8
+
+This section lists all updates associated with version 8.12.8 of the Fleet integration *Prebuilt Security Detection Rules*.
+
+
+[width="100%",options="header"]
+|==============================================
+|Rule |Description |Status |Version
+
+|<<prebuilt-rule-8-12-8-potential-execution-via-xzbackdoor, Potential Execution via XZBackdoor>> | It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor. | new | 1 
+
+|<<prebuilt-rule-8-12-8-suspicious-screenconnect-client-child-process, Suspicious ScreenConnect Client Child Process>> | Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software. | new | 1 
+
+|<<prebuilt-rule-8-12-8-potential-adidns-poisoning-via-wildcard-record-creation, Potential ADIDNS Poisoning via Wildcard Record Creation>> | Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS spoofing. | new | 1 
+
+|<<prebuilt-rule-8-12-8-creation-of-a-dns-named-record, Creation of a DNS-Named Record>> | Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks. | new | 1 
+
+|<<prebuilt-rule-8-12-8-potential-powershell-pass-the-hash-relay-script, Potential PowerShell Pass-the-Hash/Relay Script>> | Detects PowerShell scripts that can execute pass-the-hash (PtH) attacks, intercept and relay NTLM challenges, and carry out other man-in-the-middle (MitM) attacks. | new | 1 
+
+|<<prebuilt-rule-8-12-8-suspicious-access-to-ldap-attributes, Suspicious Access to LDAP Attributes>> | Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information. | new | 1 
+
+|<<prebuilt-rule-8-12-8-suspicious-jetbrains-teamcity-child-process, Suspicious JetBrains TeamCity Child Process>> | Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities. | new | 1 
+
+|<<prebuilt-rule-8-12-8-screenconnect-server-spawning-suspicious-processes, ScreenConnect Server Spawning Suspicious Processes>> | Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor. | new | 1 
+
+|<<prebuilt-rule-8-12-8-unusual-process-spawned-by-a-host, Unusual Process Spawned by a Host>> | A machine learning job has detected a suspicious Windows process. This process has been classified as suspicious in two ways. It was predicted to be suspicious by the ProblemChild supervised ML model, and it was found to be an unusual process, on a host that does not commonly manifest malicious activity. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-unusual-process-spawned-by-a-parent-process, Unusual Process Spawned by a Parent Process>> | A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be an unusual child process name, for the parent process, by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-unusual-process-spawned-by-a-user, Unusual Process Spawned by a User>> | A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity, Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity>> | A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. | update | 4 
+
+|<<prebuilt-rule-8-12-8-machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> | A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. | update | 4 
+
+|<<prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-host, Suspicious Windows Process Cluster Spawned by a Host>> | A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-parent-process, Suspicious Windows Process Cluster Spawned by a Parent Process>> | A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-suspicious-windows-process-cluster-spawned-by-a-user, Suspicious Windows Process Cluster Spawned by a User>> | A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | update | 4 
+
+|<<prebuilt-rule-8-12-8-suspicious-inter-process-communication-via-outlook, Suspicious Inter-Process Communication via Outlook>> | Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API. | update | 6 
+
+|<<prebuilt-rule-8-12-8-exporting-exchange-mailbox-via-powershell, Exporting Exchange Mailbox via PowerShell>> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 111 
+
+|<<prebuilt-rule-8-12-8-exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> | Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. | update | 108 
+
+|<<prebuilt-rule-8-12-8-powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> | Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. | update | 108 
+
+|<<prebuilt-rule-8-12-8-encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> | Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-file-transfer-via-certreq, Potential File Transfer via Certreq>> | Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. | update | 8 
+
+|<<prebuilt-rule-8-12-8-connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> | Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> | This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. | update | 110 
+
+|<<prebuilt-rule-8-12-8-connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> | Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. | update | 107 
+
+|<<prebuilt-rule-8-12-8-ingress-transfer-via-windows-bits, Ingress Transfer via Windows BITS>> | Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads. | update | 7 
+
+|<<prebuilt-rule-8-12-8-first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> | Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. | update | 5 
+
+|<<prebuilt-rule-8-12-8-port-forwarding-rule-addition, Port Forwarding Rule Addition>> | Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. | update | 110 
+
+|<<prebuilt-rule-8-12-8-potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> | Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. | update | 110 
+
+|<<prebuilt-rule-8-12-8-remote-file-download-via-desktopimgdownldr-utility, Remote File Download via Desktopimgdownldr Utility>> | Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. | update | 112 
+
+|<<prebuilt-rule-8-12-8-remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> | Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. | update | 112 
+
+|<<prebuilt-rule-8-12-8-sunburst-command-and-control-activity, SUNBURST Command and Control Activity>> | The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor. | update | 108 
+
+|<<prebuilt-rule-8-12-8-remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> | Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> | Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. | update | 112 
+
+|<<prebuilt-rule-8-12-8-ntds-or-sam-database-file-copied, NTDS or SAM Database File Copied>> | Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. | update | 112 
+
+|<<prebuilt-rule-8-12-8-creation-or-modification-of-domain-backup-dpapi-private-key, Creation or Modification of Domain Backup DPAPI private key>> | Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. | update | 108 
+
+|<<prebuilt-rule-8-12-8-credential-acquisition-via-registry-hive-dumping, Credential Acquisition via Registry Hive Dumping>> | Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. | update | 110 
+
+|<<prebuilt-rule-8-12-8-full-user-mode-dumps-enabled-system-wide, Full User-Mode Dumps Enabled System-Wide>> | Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. | update | 7 
+
+|<<prebuilt-rule-8-12-8-microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> | Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. | update | 110 
+
+|<<prebuilt-rule-8-12-8-microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> | Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. | update | 110 
+
+|<<prebuilt-rule-8-12-8-kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> | Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. | update | 110 
+
+|<<prebuilt-rule-8-12-8-kirbi-file-creation, Kirbi File Creation>> | Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets. | update | 5 
+
+|<<prebuilt-rule-8-12-8-suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> | Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. | update | 8 
+
+|<<prebuilt-rule-8-12-8-lsass-memory-dump-creation, LSASS Memory Dump Creation>> | Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. | update | 109 
+
+|<<prebuilt-rule-8-12-8-lsass-process-access-via-windows-api, LSASS Process Access via Windows API>> | Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. | update | 7 
+
+|<<prebuilt-rule-8-12-8-mimikatz-memssp-log-file-detected, Mimikatz Memssp Log File Detected>> | Identifies the password log file from the default Mimikatz memssp module. | update | 109 
+
+|<<prebuilt-rule-8-12-8-modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> | Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. | update | 109 
+
+|<<prebuilt-rule-8-12-8-windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> | Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. | update | 108 
+
+|<<prebuilt-rule-8-12-8-network-logon-provider-registry-modification, Network Logon Provider Registry Modification>> | Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon. | update | 109 
+
+|<<prebuilt-rule-8-12-8-potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> | Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. | update | 109 
+
+|<<prebuilt-rule-8-12-8-potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> | Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. | update | 111 
+
+|<<prebuilt-rule-8-12-8-searching-for-saved-credentials-via-vaultcmd, Searching for Saved Credentials via VaultCmd>> | Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. | update | 109 
+
+|<<prebuilt-rule-8-12-8-symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> | Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. | update | 111 
+
+|<<prebuilt-rule-8-12-8-veeam-backup-library-loaded-by-unusual-process, Veeam Backup Library Loaded by Unusual Process>> | Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks. | update | 2 
+
+|<<prebuilt-rule-8-12-8-wireless-credential-dumping-using-netsh-command, Wireless Credential Dumping using Netsh Command>> | Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh. | update | 8 
+
+|<<prebuilt-rule-8-12-8-adding-hidden-file-attribute-via-attrib, Adding Hidden File Attribute via Attrib>> | Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection. | update | 111 
+
+|<<prebuilt-rule-8-12-8-suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> | Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. | update | 9 
+
+|<<prebuilt-rule-8-12-8-modification-of-amsienable-registry-key, Modification of AmsiEnable Registry Key>> | Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections. | update | 110 
+
+|<<prebuilt-rule-8-12-8-clearing-windows-console-history, Clearing Windows Console History>> | Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. | update | 111 
+
+|<<prebuilt-rule-8-12-8-clearing-windows-event-logs, Clearing Windows Event Logs>> | Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. | update | 112 
+
+|<<prebuilt-rule-8-12-8-code-signing-policy-modification-through-built-in-tools, Code Signing Policy Modification Through Built-in tools>> | Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. | update | 7 
+
+|<<prebuilt-rule-8-12-8-code-signing-policy-modification-through-registry, Code Signing Policy Modification Through Registry>> | Identifies attempts to disable the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. | update | 9 
+
+|<<prebuilt-rule-8-12-8-creation-or-modification-of-root-certificate, Creation or Modification of Root Certificate>> | Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic. | update | 110 
+
+|<<prebuilt-rule-8-12-8-windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> | Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. | update | 111 
+
+|<<prebuilt-rule-8-12-8-windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> | Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. | update | 110 
+
+|<<prebuilt-rule-8-12-8-delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> | Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. | update | 109 
+
+|<<prebuilt-rule-8-12-8-powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> | Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. | update | 109 
+
+|<<prebuilt-rule-8-12-8-disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> | Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. | update | 110 
+
+|<<prebuilt-rule-8-12-8-disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> | Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. | update | 110 
+
+|<<prebuilt-rule-8-12-8-disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> | Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. | update | 112 
+
+|<<prebuilt-rule-8-12-8-dns-over-https-enabled-via-registry, DNS-over-HTTPS Enabled via Registry>> | Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors. | update | 109 
+
+|<<prebuilt-rule-8-12-8-suspicious-net-code-compilation, Suspicious .NET Code Compilation>> | Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt to compile code after delivery in order to bypass security mechanisms. | update | 110 
+
+|<<prebuilt-rule-8-12-8-remote-desktop-enabled-in-windows-firewall-by-netsh, Remote Desktop Enabled in Windows Firewall by Netsh>> | Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. | update | 110 
+
+|<<prebuilt-rule-8-12-8-enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> | Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. | update | 109 
+
+|<<prebuilt-rule-8-12-8-control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> | Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. | update | 111 
+
+|<<prebuilt-rule-8-12-8-imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> | Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. | update | 112 
+
+|<<prebuilt-rule-8-12-8-microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> | An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. | update | 110 
+
+|<<prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> | An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. | update | 209 
+
+|<<prebuilt-rule-8-12-8-microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> | An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. | update | 110 
+
+|<<prebuilt-rule-8-12-8-microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> | An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. | update | 112 
+
+|<<prebuilt-rule-8-12-8-microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> | An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. | update | 211 
+
+|<<prebuilt-rule-8-12-8-potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> | Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. | update | 110 
+
+|<<prebuilt-rule-8-12-8-potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> | Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. | update | 110 
+
+|<<prebuilt-rule-8-12-8-executable-file-creation-with-multiple-extensions, Executable File Creation with Multiple Extensions>> | Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. | update | 108 
+
+|<<prebuilt-rule-8-12-8-process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> | Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. | update | 110 
+
+|<<prebuilt-rule-8-12-8-encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> | Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. | update | 107 
+
+|<<prebuilt-rule-8-12-8-iis-http-logging-disabled, IIS HTTP Logging Disabled>> | Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> | A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> | Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. | update | 4 
+
+|<<prebuilt-rule-8-12-8-potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> | Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. | update | 5 
+
+|<<prebuilt-rule-8-12-8-renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> | Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-werfault-child-process, Suspicious WerFault Child Process>> | A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes. | update | 112 
+
+|<<prebuilt-rule-8-12-8-program-files-directory-masquerading, Program Files Directory Masquerading>> | Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. | update | 109 
+
+|<<prebuilt-rule-8-12-8-microsoft-windows-defender-tampering, Microsoft Windows Defender Tampering>> | Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior. | update | 110 
+
+|<<prebuilt-rule-8-12-8-parent-process-pid-spoofing, Parent Process PID Spoofing>> | Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. | update | 106 
+
+|<<prebuilt-rule-8-12-8-local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> | Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. | update | 8 
+
+|<<prebuilt-rule-8-12-8-suspicious-net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> | Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. | update | 212 
+
+|<<prebuilt-rule-8-12-8-powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> | Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. | update | 211 
+
+|<<prebuilt-rule-8-12-8-windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> | Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> | Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. | update | 109 
+
+|<<prebuilt-rule-8-12-8-unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> | Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. | update | 108 
+
+|<<prebuilt-rule-8-12-8-scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> | Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. | update | 109 
+
+|<<prebuilt-rule-8-12-8-potential-secure-file-deletion-via-sdelete-utility, Potential Secure File Deletion via SDelete Utility>> | Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations. | update | 109 
+
+|<<prebuilt-rule-8-12-8-sip-provider-modification, SIP Provider Modification>> | Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes. | update | 107 
+
+|<<prebuilt-rule-8-12-8-solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> | Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. | update | 109 
+
+|<<prebuilt-rule-8-12-8-suspicious-certutil-commands, Suspicious CertUtil Commands>> | Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. | update | 108 
+
+|<<prebuilt-rule-8-12-8-suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> | Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. | update | 108 
+
+|<<prebuilt-rule-8-12-8-renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> | Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. | update | 109 
+
+|<<prebuilt-rule-8-12-8-suspicious-zoom-child-process, Suspicious Zoom Child Process>> | A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. | update | 110 
+
+|<<prebuilt-rule-8-12-8-unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> | Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. | update | 111 
+
+|<<prebuilt-rule-8-12-8-unsigned-dll-side-loading-from-a-suspicious-folder, Unsigned DLL Side-Loading from a Suspicious Folder>> | Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes. | update | 8 
+
+|<<prebuilt-rule-8-12-8-untrusted-driver-loaded, Untrusted Driver Loaded>> | Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. | update | 7 
+
+|<<prebuilt-rule-8-12-8-unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> | Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. | update | 114 
+
+|<<prebuilt-rule-8-12-8-unusual-process-execution-path-alternate-data-stream, Unusual Process Execution Path - Alternate Data Stream>> | Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. | update | 109 
+
+|<<prebuilt-rule-8-12-8-unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> | Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. | update | 110 
+
+|<<prebuilt-rule-8-12-8-potential-evasion-via-filter-manager, Potential Evasion via Filter Manager>> | The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. | update | 110 
+
+|<<prebuilt-rule-8-12-8-potential-evasion-via-windows-filtering-platform, Potential Evasion via Windows Filtering Platform>> | Identifies multiple Windows Filtering Platform block events and where the process name is related to an endpoint security software. Adversaries may add malicious WFP rules to prevent Endpoint security from sending telemetry. | update | 3 
+
+|<<prebuilt-rule-8-12-8-suspicious-execution-via-windows-subsystem-for-linux, Suspicious Execution via Windows Subsystem for Linux>> | Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | update | 6 
+
+|<<prebuilt-rule-8-12-8-execution-via-windows-subsystem-for-linux, Execution via Windows Subsystem for Linux>> | Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | update | 6 
+
+|<<prebuilt-rule-8-12-8-windows-subsystem-for-linux-enabled-via-dism-utility, Windows Subsystem for Linux Enabled via Dism Utility>> | Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. | update | 7 
+
+|<<prebuilt-rule-8-12-8-attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> | Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. | update | 7 
+
+|<<prebuilt-rule-8-12-8-windows-subsystem-for-linux-distribution-installed, Windows Subsystem for Linux Distribution Installed>> | Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection. | update | 7 
+
+|<<prebuilt-rule-8-12-8-adfind-command-activity, AdFind Command Activity>> | This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. | update | 111 
+
+|<<prebuilt-rule-8-12-8-enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> | Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. | update | 112 
+
+|<<prebuilt-rule-8-12-8-account-discovery-command-via-system-account, Account Discovery Command via SYSTEM Account>> | Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. | update | 111 
+
+|<<prebuilt-rule-8-12-8-enumerating-domain-trusts-via-dsquery-exe, Enumerating Domain Trusts via DSQUERY.EXE>> | Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments. | update | 7 
+
+|<<prebuilt-rule-8-12-8-enumerating-domain-trusts-via-nltest-exe, Enumerating Domain Trusts via NLTEST.EXE>> | Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. | update | 110 
+
+|<<prebuilt-rule-8-12-8-group-policy-discovery-via-microsoft-gpresult-utility, Group Policy Discovery via Microsoft GPResult Utility>> | Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally. | update | 8 
+
+|<<prebuilt-rule-8-12-8-peripheral-device-discovery, Peripheral Device Discovery>> | Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system. | update | 109 
+
+|<<prebuilt-rule-8-12-8-powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> | This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. | update | 213 
+
+|<<prebuilt-rule-8-12-8-enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> | Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. | update | 311 
+
+|<<prebuilt-rule-8-12-8-whoami-process-activity, Whoami Process Activity>> | Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system. | update | 111 
+
+|<<prebuilt-rule-8-12-8-command-execution-via-solarwinds-process, Command Execution via SolarWinds Process>> | A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected. | update | 111 
+
+|<<prebuilt-rule-8-12-8-suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> | A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. | update | 110 
+
+|<<prebuilt-rule-8-12-8-execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> | Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. | update | 109 
+
+|<<prebuilt-rule-8-12-8-svchost-spawning-cmd, Svchost spawning Cmd>> | Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe | update | 211 
+
+|<<prebuilt-rule-8-12-8-unusual-parent-process-for-cmd-exe, Unusual Parent Process for cmd.exe>> | Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process. | update | 110 
+
+|<<prebuilt-rule-8-12-8-command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> | Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. | update | 110 
+
+|<<prebuilt-rule-8-12-8-enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> | Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). | update | 111 
+
+|<<prebuilt-rule-8-12-8-execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> | Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. | update | 112 
+
+|<<prebuilt-rule-8-12-8-potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> | Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. | update | 111 
+
+|<<prebuilt-rule-8-12-8-powershell-psreflect-script, PowerShell PSReflect Script>> | Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. | update | 210 
+
+|<<prebuilt-rule-8-12-8-outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> | Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. | update | 107 
+
+|<<prebuilt-rule-8-12-8-execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> | Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. | update | 108 
+
+|<<prebuilt-rule-8-12-8-suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> | Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. | update | 111 
+
+|<<prebuilt-rule-8-12-8-suspicious-wmi-image-load-from-ms-office, Suspicious WMI Image Load from MS Office>> | Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. | update | 108 
+
+|<<prebuilt-rule-8-12-8-suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> | Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> | Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. | update | 210 
+
+|<<prebuilt-rule-8-12-8-suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> | Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. | update | 111 
+
+|<<prebuilt-rule-8-12-8-process-activity-via-compiled-html-file, Process Activity via Compiled HTML File>> | Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). | update | 110 
+
+|<<prebuilt-rule-8-12-8-conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> | Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. | update | 110 
+
+|<<prebuilt-rule-8-12-8-rare-smb-connection-to-the-internet, Rare SMB Connection to the Internet>> | This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection. | update | 3 
+
+|<<prebuilt-rule-8-12-8-third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> | Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. | update | 112 
+
+|<<prebuilt-rule-8-12-8-deleting-backup-catalogs-with-wbadmin, Deleting Backup Catalogs with Wbadmin>> | Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. | update | 111 
+
+|<<prebuilt-rule-8-12-8-modification-of-boot-configuration, Modification of Boot Configuration>> | Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. | update | 109 
+
+|<<prebuilt-rule-8-12-8-high-number-of-process-and-or-service-terminations, High Number of Process and/or Service Terminations>> | This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. | update | 109 
+
+|<<prebuilt-rule-8-12-8-volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> | Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. | update | 111 
+
+|<<prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-powershell, Volume Shadow Copy Deletion via PowerShell>> | Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. | update | 111 
+
+|<<prebuilt-rule-8-12-8-volume-shadow-copy-deletion-via-wmic, Volume Shadow Copy Deletion via WMIC>> | Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> | Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. | update | 2 
+
+|<<prebuilt-rule-8-12-8-suspicious-execution-via-microsoft-office-add-ins, Suspicious Execution via Microsoft Office Add-Ins>> | Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In. | update | 5 
+
+|<<prebuilt-rule-8-12-8-first-time-seen-removable-device, First Time Seen Removable Device>> | Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. | update | 4 
+
+|<<prebuilt-rule-8-12-8-windows-script-executing-powershell, Windows Script Executing PowerShell>> | Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. | update | 111 
+
+|<<prebuilt-rule-8-12-8-microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> | Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. | update | 108 
+
+|<<prebuilt-rule-8-12-8-microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> | Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. | update | 109 
+
+|<<prebuilt-rule-8-12-8-microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> | Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. | update | 109 
+
+|<<prebuilt-rule-8-12-8-suspicious-ms-office-child-process, Suspicious MS Office Child Process>> | Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. | update | 112 
+
+|<<prebuilt-rule-8-12-8-suspicious-ms-outlook-child-process, Suspicious MS Outlook Child Process>> | Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity. | update | 111 
+
+|<<prebuilt-rule-8-12-8-suspicious-explorer-child-process, Suspicious Explorer Child Process>> | Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process. | update | 109 
+
+|<<prebuilt-rule-8-12-8-nullsessionpipe-registry-modification, NullSessionPipe Registry Modification>> | Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone. | update | 108 
+
+|<<prebuilt-rule-8-12-8-execution-via-tsclient-mountpoint, Execution via TSClient Mountpoint>> | Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt. | update | 109 
+
+|<<prebuilt-rule-8-12-8-mounting-hidden-or-webdav-remote-shares, Mounting Hidden or WebDav Remote Shares>> | Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration. | update | 109 
+
+|<<prebuilt-rule-8-12-8-rdp-enabled-via-registry, RDP Enabled via Registry>> | Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. | update | 111 
+
+|<<prebuilt-rule-8-12-8-remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> | Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. | update | 109 
+
+|<<prebuilt-rule-8-12-8-remotely-started-services-via-rpc, Remotely Started Services via RPC>> | Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators. | update | 111 
+
+|<<prebuilt-rule-8-12-8-suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> | Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. | update | 109 
+
+|<<prebuilt-rule-8-12-8-unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> | Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. | update | 110 
+
+|<<prebuilt-rule-8-12-8-unusual-file-modification-by-dns-exe, Unusual File Modification by dns.exe>> | Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. | update | 110 
+
+|<<prebuilt-rule-8-12-8-lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> | Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. | update | 108 
+
+|<<prebuilt-rule-8-12-8-adobe-hijack-persistence, Adobe Hijack Persistence>> | Detects writing executable files that will be automatically launched by Adobe on launch. | update | 111 
+
+|<<prebuilt-rule-8-12-8-installation-of-custom-shim-databases, Installation of Custom Shim Databases>> | Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. | update | 108 
+
+|<<prebuilt-rule-8-12-8-registry-persistence-via-appcert-dll, Registry Persistence via AppCert DLL>> | Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes. | update | 108 
+
+|<<prebuilt-rule-8-12-8-registry-persistence-via-appinit-dll, Registry Persistence via AppInit DLL>> | AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine. | update | 110 
+
+|<<prebuilt-rule-8-12-8-creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> | Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. | update | 110 
+
+|<<prebuilt-rule-8-12-8-image-file-execution-options-injection, Image File Execution Options Injection>> | The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence. | update | 107 
+
+|<<prebuilt-rule-8-12-8-suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> | Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. | update | 110 
+
+|<<prebuilt-rule-8-12-8-persistence-via-scheduled-job-creation, Persistence via Scheduled Job Creation>> | A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. | update | 108 
+
+|<<prebuilt-rule-8-12-8-local-scheduled-task-creation, Local Scheduled Task Creation>> | Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. | update | 107 
+
+|<<prebuilt-rule-8-12-8-persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> | Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. | update | 108 
+
+|<<prebuilt-rule-8-12-8-persistence-via-microsoft-outlook-vba, Persistence via Microsoft Outlook VBA>> | Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template. | update | 107 
+
+|<<prebuilt-rule-8-12-8-new-activesyncalloweddeviceid-added-via-powershell, New ActiveSyncAllowedDeviceID Added via PowerShell>> | Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. | update | 109 
+
+|<<prebuilt-rule-8-12-8-persistence-via-powershell-profile, Persistence via PowerShell profile>> | Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common. | update | 9 
+
+|<<prebuilt-rule-8-12-8-potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> | Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. | update | 111 
+
+|<<prebuilt-rule-8-12-8-uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> | Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. | update | 107 
+
+|<<prebuilt-rule-8-12-8-startup-or-run-key-registry-modification, Startup or Run Key Registry Modification>> | Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. | update | 111 
+
+|<<prebuilt-rule-8-12-8-execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> | Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. | update | 107 
+
+|<<prebuilt-rule-8-12-8-unsigned-dll-loaded-by-svchost, Unsigned DLL Loaded by Svchost>> | Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges. | update | 6 
+
+|<<prebuilt-rule-8-12-8-unusual-persistence-via-services-registry, Unusual Persistence via Services Registry>> | Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service. | update | 108 
+
+|<<prebuilt-rule-8-12-8-startup-persistence-by-a-suspicious-process, Startup Persistence by a Suspicious Process>> | Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence. | update | 110 
+
+|<<prebuilt-rule-8-12-8-persistent-scripts-in-the-startup-directory, Persistent Scripts in the Startup Directory>> | Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment. | update | 111 
+
+|<<prebuilt-rule-8-12-8-component-object-model-hijacking, Component Object Model Hijacking>> | Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. | update | 112 
+
+|<<prebuilt-rule-8-12-8-suspicious-image-load-taskschd-dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> | Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. | update | 109 
+
+|<<prebuilt-rule-8-12-8-suspicious-execution-via-scheduled-task, Suspicious Execution via Scheduled Task>> | Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. | update | 108 
+
+|<<prebuilt-rule-8-12-8-suspicious-imagepath-service-creation, Suspicious ImagePath Service Creation>> | Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation. | update | 107 
+
+|<<prebuilt-rule-8-12-8-system-shells-via-services, System Shells via Services>> | Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. | update | 110 
+
+|<<prebuilt-rule-8-12-8-potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> | Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. | update | 109 
+
+|<<prebuilt-rule-8-12-8-user-account-creation, User Account Creation>> | Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain. | update | 109 
+
+|<<prebuilt-rule-8-12-8-potential-application-shimming-via-sdbinst, Potential Application Shimming via Sdbinst>> | The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. | update | 110 
+
+|<<prebuilt-rule-8-12-8-persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> | An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. | update | 107 
+
+|<<prebuilt-rule-8-12-8-persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> | Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). | update | 108 
+
+|<<prebuilt-rule-8-12-8-installation-of-security-support-provider, Installation of Security Support Provider>> | Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment. | update | 108 
+
+|<<prebuilt-rule-8-12-8-persistence-via-telemetrycontroller-scheduled-task-hijack, Persistence via TelemetryController Scheduled Task Hijack>> | Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. | update | 110 
+
+|<<prebuilt-rule-8-12-8-persistence-via-update-orchestrator-service-hijack, Persistence via Update Orchestrator Service Hijack>> | Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM. | update | 111 
+
+|<<prebuilt-rule-8-12-8-persistence-via-wmi-event-subscription, Persistence via WMI Event Subscription>> | An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. | update | 111 
+
+|<<prebuilt-rule-8-12-8-persistence-via-wmi-standard-registry-provider, Persistence via WMI Standard Registry Provider>> | Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence. | update | 108 
+
+|<<prebuilt-rule-8-12-8-execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> | Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. | update | 111 
+
+|<<prebuilt-rule-8-12-8-web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> | Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. | update | 111 
+
+|<<prebuilt-rule-8-12-8-process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> | Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. | update | 3 
+
+|<<prebuilt-rule-8-12-8-disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> | User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. | update | 110 
+
+|<<prebuilt-rule-8-12-8-first-time-seen-driver-loaded, First Time Seen Driver Loaded>> | Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment. | update | 7 
+
+|<<prebuilt-rule-8-12-8-expired-or-revoked-driver-loaded, Expired or Revoked Driver Loaded>> | Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers. | update | 5 
+
+|<<prebuilt-rule-8-12-8-creation-or-modification-of-a-new-gpo-scheduled-task-or-service, Creation or Modification of a new GPO Scheduled Task or Service>> | Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. | update | 109 
+
+|<<prebuilt-rule-8-12-8-potential-privilege-escalation-via-installerfiletakeover, Potential Privilege Escalation via InstallerFileTakeOver>> | Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> | Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. | update | 105 
+
+|<<prebuilt-rule-8-12-8-privilege-escalation-via-named-pipe-impersonation, Privilege Escalation via Named Pipe Impersonation>> | Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command. | update | 110 
+
+|<<prebuilt-rule-8-12-8-suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> | Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. | update | 111 
+
+|<<prebuilt-rule-8-12-8-potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> | Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. | update | 106 
+
+|<<prebuilt-rule-8-12-8-suspicious-print-spooler-point-and-print-dll, Suspicious Print Spooler Point and Print DLL>> | Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM. | update | 106 
+
+|<<prebuilt-rule-8-12-8-suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> | Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. | update | 108 
+
+|<<prebuilt-rule-8-12-8-suspicious-print-spooler-file-deletion, Suspicious Print Spooler File Deletion>> | Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. | update | 107 
+
+|<<prebuilt-rule-8-12-8-suspicious-print-spooler-spl-file-created, Suspicious Print Spooler SPL File Created>> | Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337. | update | 111 
+
+|<<prebuilt-rule-8-12-8-privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> | Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. | update | 106 
+
+|<<prebuilt-rule-8-12-8-service-control-spawned-via-script-interpreter, Service Control Spawned via Script Interpreter>> | Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence. | update | 108 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> | Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 109 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer, UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer>> | Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 109 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-via-icmluautil-elevated-com-interface, UAC Bypass via ICMLuaUtil Elevated COM Interface>> | Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 109 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-via-diskcleanup-scheduled-task-hijack, UAC Bypass via DiskCleanup Scheduled Task Hijack>> | Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 109 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> | Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. | update | 109 
+
+|<<prebuilt-rule-8-12-8-bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> | Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 112 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> | Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. | update | 112 
+
+|<<prebuilt-rule-8-12-8-uac-bypass-via-windows-firewall-snap-in-hijack, UAC Bypass via Windows Firewall Snap-In Hijack>> | Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. | update | 111 
+
+|<<prebuilt-rule-8-12-8-unusual-parent-child-relationship, Unusual Parent-Child Relationship>> | Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. | update | 111 
+
+|<<prebuilt-rule-8-12-8-unusual-print-spooler-child-process, Unusual Print Spooler Child Process>> | Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. | update | 108 
+
+|<<prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service, Unusual Service Host Child Process - Childless Service>> | Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation. | update | 110 
+
+|<<prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing, Privileges Elevation via Parent Process PID Spoofing>> | Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. | update | 7 
+
+|<<prebuilt-rule-8-12-8-process-created-with-an-elevated-token, Process Created with an Elevated Token>> | Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. | update | 6 
+
+|<<prebuilt-rule-8-12-8-deprecated-remote-file-creation-on-a-sensitive-directory, Deprecated - Remote File Creation on a Sensitive Directory>> | Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these directories could indicate a malicious binary or script trying to compromise the system. | deprecated | 3 
+
+|==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index 4a989a5669..fea83b0430 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -13,6 +13,10 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 |Update version |Date | New rules | Updated rules | Notes
 
 
+|<<prebuilt-rule-8-12-8-prebuilt-rules-8-12-8-summary, 8.12.8>> | 03 Apr 2024 | 8 | 238 | 
+Adding Release Notes to 8.12.8
+
+
 |<<prebuilt-rule-8-12-7-prebuilt-rules-8-12-7-summary, 8.12.7>> | 25 Mar 2024 | 5 | 549 | 
 This release includes new rules for Linux and Windows and tuned rules for Linux, Windows and macOS.
 New rules for Linux include detection for execution.
@@ -66,3 +70,4 @@ include::downloadable-packages/8-12-4/prebuilt-rules-8-12-4-summary.asciidoc[lev
 include::downloadable-packages/8-12-5/prebuilt-rules-8-12-5-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-12-6/prebuilt-rules-8-12-6-summary.asciidoc[leveloffset=+1]
 include::downloadable-packages/8-12-7/prebuilt-rules-8-12-7-summary.asciidoc[leveloffset=+1]
+include::downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc[leveloffset=+1]
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
index f92e4edbaf..5c6c2f4674 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-reference.asciidoc
@@ -144,15 +144,15 @@ and their rule type is `machine_learning`.
 
 |<<account-configured-with-never-expiring-password, Account Configured with Never-Expiring Password>> |Detects the creation and modification of an account with the "Don't Expire Password" option Enabled. Attackers can abuse this misconfiguration to persist in the domain and maintain long-term access using compromised accounts with this property. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |108
 
-|<<account-discovery-command-via-system-account, Account Discovery Command via SYSTEM Account>> |Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<account-discovery-command-via-system-account, Account Discovery Command via SYSTEM Account>> |Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
-|<<account-password-reset-remotely, Account Password Reset Remotely>> |Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Impact] |8.3.0 |112
+|<<account-password-reset-remotely, Account Password Reset Remotely>> |Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Impact] |8.3.0 |114
 
 |<<account-or-group-discovery-via-built-in-tools, Account or Group Discovery via Built-In Tools>> |Adversaries may use built-in applications to get a listing of local system or domain accounts and groups. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |3
 
-|<<adfind-command-activity, AdFind Command Activity>> |This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<adfind-command-activity, AdFind Command Activity>> |This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<adding-hidden-file-attribute-via-attrib, Adding Hidden File Attribute via Attrib>> |Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
+|<<adding-hidden-file-attribute-via-attrib, Adding Hidden File Attribute via Attrib>> |Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<adminsdholder-backdoor, AdminSDHolder Backdoor>> |Detects modifications in the AdminSDHolder object. Attackers can abuse the SDProp process to implement a persistent backdoor in Active Directory. SDProp compares the permissions on protected objects with those defined on the AdminSDHolder object. If the permissions on any of the protected accounts and groups do not match, the permissions on the protected accounts and groups are reset to match those of the domain's AdminSDHolder object, regaining their Administrative Privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |106
 
@@ -162,7 +162,7 @@ and their rule type is `machine_learning`.
 
 |<<administrator-role-assigned-to-an-okta-user, Administrator Role Assigned to an Okta User>> |Identifies when an administrator role is assigned to an Okta user. An adversary may attempt to assign an administrator role to an Okta user in order to assign additional permissions to a user account and maintain access to their target's environment. |[Data Source: Okta], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.10.0 |205
 
-|<<adobe-hijack-persistence, Adobe Hijack Persistence>> |Detects writing executable files that will be automatically launched by Adobe on launch. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<adobe-hijack-persistence, Adobe Hijack Persistence>> |Detects writing executable files that will be automatically launched by Adobe on launch. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<adversary-behavior-detected-elastic-endgame, Adversary Behavior - Detected - Elastic Endgame>> |Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |103
 
@@ -218,7 +218,7 @@ and their rule type is `machine_learning`.
 
 |<<attempt-to-enable-the-root-account, Attempt to Enable the Root Account>> |Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> |Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
+|<<attempt-to-install-kali-linux-via-wsl, Attempt to Install Kali Linux via WSL>> |Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |7
 
 |<<attempt-to-install-root-certificate, Attempt to Install Root Certificate>> |Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -244,7 +244,7 @@ and their rule type is `machine_learning`.
 
 |<<attempted-private-key-access, Attempted Private Key Access>> |Attackers may try to access private keys, e.g. ssh, in order to gain further authenticated access to the environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
-|<<attempts-to-brute-force-a-microsoft-365-user-account, Attempts to Brute Force a Microsoft 365 User Account>> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |106
+|<<attempts-to-brute-force-a-microsoft-365-user-account, Attempts to Brute Force a Microsoft 365 User Account>> |Identifies attempts to brute force a Microsoft 365 user account. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.8.0 |207
 
 |<<attempts-to-brute-force-an-okta-user-account, Attempts to Brute Force an Okta User Account>> |Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts. |[Use Case: Identity and Access Audit], [Tactic: Credential Access], [Data Source: Okta] |8.10.0 |208
 
@@ -330,37 +330,37 @@ and their rule type is `machine_learning`.
 
 |<<browser-extension-install, Browser Extension Install>> |Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<bypass-uac-via-event-viewer, Bypass UAC via Event Viewer>> |Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<cap-sys-admin-assigned-to-binary, CAP_SYS_ADMIN Assigned to Binary>> |Identifies instances where a binary is granted the CAP_SYS_ADMIN capability. In Linux, the CAP_SYS_ADMIN capability is a powerful and broad capability that allows a process to perform a range of system administration operations, such as mounting and unmounting filesystems, configuring network interfaces, and accessing hardware devices. Attackers may leverage a misconfiguration for exploitation in order to escalate their privileges to root. The rule identifies previously unknown processes executing with CAP_SYS_ADMIN capabilities through the use of the new terms rule type. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Rule Type: BBR] |8.11.0 |2
 
 |<<chkconfig-service-add, Chkconfig Service Add>> |Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Threat: Lightning Framework], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<clearing-windows-console-history, Clearing Windows Console History>> |Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<clearing-windows-event-logs, Clearing Windows Event Logs>> |Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<cobalt-strike-command-and-control-beacon, Cobalt Strike Command and Control Beacon>> |Cobalt Strike is a threat emulation platform commonly modified and used by adversaries to conduct network attack and exploitation campaigns. This rule detects a network activity algorithm leveraged by Cobalt Strike implant beacons for command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |105
 
-|<<code-signing-policy-modification-through-built-in-tools, Code Signing Policy Modification Through Built-in tools>> |Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |6
+|<<code-signing-policy-modification-through-built-in-tools, Code Signing Policy Modification Through Built-in tools>> |Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |7
 
-|<<code-signing-policy-modification-through-registry, Code Signing Policy Modification Through Registry>> |Identifies attempts to disable the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |8
+|<<code-signing-policy-modification-through-registry, Code Signing Policy Modification Through Registry>> |Identifies attempts to disable the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |9
 
-|<<command-execution-via-solarwinds-process, Command Execution via SolarWinds Process>> |A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<command-execution-via-solarwinds-process, Command Execution via SolarWinds Process>> |A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<command-prompt-network-connection, Command Prompt Network Connection>> |Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> |Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<command-shell-activity-started-via-rundll32, Command Shell Activity Started via RunDLL32>> |Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<component-object-model-hijacking, Component Object Model Hijacking>> |Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<compression-dll-loaded-by-unusual-process, Compression DLL Loaded by Unusual Process>> |Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
-|<<conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> |Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<conhost-spawned-by-suspicious-parent-process, Conhost Spawned By Suspicious Parent Process>> |Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<connection-to-commonly-abused-free-ssl-certificate-providers, Connection to Commonly Abused Free SSL Certificate Providers>> |Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
+|<<connection-to-commonly-abused-web-services, Connection to Commonly Abused Web Services>> |Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<connection-to-external-network-via-telnet, Connection to External Network via Telnet>> |Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -370,7 +370,7 @@ and their rule type is `machine_learning`.
 
 |<<container-workload-protection, Container Workload Protection>> |Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts. |[Data Source: Elastic Defend for Containers], [Domain: Container] |8.8.0 |3
 
-|<<control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> |Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<control-panel-process-with-unusual-arguments, Control Panel Process with Unusual Arguments>> |Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<creation-of-hidden-files-and-directories-via-commandline, Creation of Hidden Files and Directories via CommandLine>> |Users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |110
 
@@ -384,15 +384,17 @@ and their rule type is `machine_learning`.
 
 |<<creation-of-settingcontent-ms-files, Creation of SettingContent-ms Files>> |Identifies the suspicious creation of SettingContents-ms files, which have been used in attacks to achieve code execution while evading defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
-|<<creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> |Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<creation-of-a-dns-named-record, Creation of a DNS-Named Record>> |Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Use Case: Active Directory Monitoring] |8.3.0 |1
 
-|<<creation-or-modification-of-domain-backup-dpapi-private-key, Creation or Modification of Domain Backup DPAPI private key>> |Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<creation-of-a-hidden-local-user-account, Creation of a Hidden Local User Account>> |Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<creation-or-modification-of-root-certificate, Creation or Modification of Root Certificate>> |Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<creation-or-modification-of-domain-backup-dpapi-private-key, Creation or Modification of Domain Backup DPAPI private key>> |Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<creation-or-modification-of-a-new-gpo-scheduled-task-or-service, Creation or Modification of a new GPO Scheduled Task or Service>> |Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<creation-or-modification-of-root-certificate, Creation or Modification of Root Certificate>> |Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<credential-acquisition-via-registry-hive-dumping, Credential Acquisition via Registry Hive Dumping>> |Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<creation-or-modification-of-a-new-gpo-scheduled-task-or-service, Creation or Modification of a new GPO Scheduled Task or Service>> |Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+
+|<<credential-acquisition-via-registry-hive-dumping, Credential Acquisition via Registry Hive Dumping>> |Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<credential-dumping-detected-elastic-endgame, Credential Dumping - Detected - Elastic Endgame>> |Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |102
 
@@ -410,27 +412,25 @@ and their rule type is `machine_learning`.
 
 |<<dns-tunneling, DNS Tunneling>> |A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.3.0 |103
 
-|<<dns-over-https-enabled-via-registry, DNS-over-HTTPS Enabled via Registry>> |Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<dns-over-https-enabled-via-registry, DNS-over-HTTPS Enabled via Registry>> |Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<default-cobalt-strike-team-server-certificate, Default Cobalt Strike Team Server Certificate>> |This rule detects the use of the default Cobalt Strike Team Server TLS certificate. Cobalt Strike is software for Adversary Simulations and Red Team Operations which are security assessments that replicate the tactics and techniques of an advanced adversary in a network. Modifications to the Packetbeat configuration can be made to include MD5 and SHA256 hashing algorithms (the default is SHA1). See the References section for additional information on module configuration. |[Tactic: Command and Control], [Threat: Cobalt Strike], [Use Case: Threat Detection], [Domain: Endpoint] |8.3.0 |104
 
 |<<delayed-execution-via-ping, Delayed Execution via Ping>> |Identifies the execution of commonly abused Windows utilities via a delayed Ping execution. This behavior is often observed during malware installation and is consistent with an attacker attempting to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> |Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
-
-|<<deleting-backup-catalogs-with-wbadmin, Deleting Backup Catalogs with Wbadmin>> |Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<delete-volume-usn-journal-with-fsutil, Delete Volume USN Journal with Fsutil>> |Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<deprecated-remote-file-creation-on-a-sensitive-directory, Deprecated - Remote File Creation on a Sensitive Directory>> |Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these directories could indicate a malicious binary or script trying to compromise the system. |[Domain: Endpoint], [Use Case: Lateral Movement Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.9.0 |2
+|<<deleting-backup-catalogs-with-wbadmin, Deleting Backup Catalogs with Wbadmin>> |Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<direct-outbound-smb-connection, Direct Outbound SMB Connection>> |Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<disable-windows-event-and-security-logs-using-built-in-tools, Disable Windows Event and Security Logs Using Built-in Tools>> |Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
-|<<disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> |Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<disable-windows-firewall-rules-via-netsh, Disable Windows Firewall Rules via Netsh>> |Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> |User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<disabling-user-account-control-via-registry-modification, Disabling User Account Control via Registry Modification>> |User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<disabling-windows-defender-security-settings-via-powershell, Disabling Windows Defender Security Settings via PowerShell>> |Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<discovery-of-domain-groups, Discovery of Domain Groups>> |Identifies the execution of Linux built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |2
 
@@ -460,49 +460,49 @@ and their rule type is `machine_learning`.
 
 |<<emond-rules-creation-or-modification, Emond Rules Creation or Modification>> |Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> |Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<enable-host-network-discovery-via-netsh, Enable Host Network Discovery via Netsh>> |Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> |Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<encoded-executable-stored-in-the-registry, Encoded Executable Stored in the Registry>> |Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<encrypting-files-with-winrar-or-7z, Encrypting Files with WinRar or 7z>> |Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<endpoint-security, Endpoint Security>> |Generates a detection alert each time an Elastic Endpoint Security alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts. |[Data Source: Elastic Defend] |8.3.0 |102
 
-|<<enumerating-domain-trusts-via-dsquery-exe, Enumerating Domain Trusts via DSQUERY.EXE>> |Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |6
+|<<enumerating-domain-trusts-via-dsquery-exe, Enumerating Domain Trusts via DSQUERY.EXE>> |Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |7
 
-|<<enumerating-domain-trusts-via-nltest-exe, Enumerating Domain Trusts via NLTEST.EXE>> |Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<enumerating-domain-trusts-via-nltest-exe, Enumerating Domain Trusts via NLTEST.EXE>> |Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> |Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<enumeration-command-spawned-via-wmiprvse, Enumeration Command Spawned via WMIPrvSE>> |Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> |Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<enumeration-of-administrator-accounts, Enumeration of Administrator Accounts>> |Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<enumeration-of-kernel-modules, Enumeration of Kernel Modules>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.6.0 |209
 
 |<<enumeration-of-kernel-modules-via-proc, Enumeration of Kernel Modules via Proc>> |Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |106
 
-|<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.6.0 |211
+|<<enumeration-of-privileged-local-groups-membership, Enumeration of Privileged Local Groups Membership>> |Identifies instances of an unusual process enumerating built-in Windows privileged local groups membership like Administrators or Remote Desktop users. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide] |8.12.0 |311
 
 |<<enumeration-of-users-or-groups-via-built-in-commands, Enumeration of Users or Groups via Built-in Commands>> |Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |8
+|<<exchange-mailbox-export-via-powershell, Exchange Mailbox Export via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.12.0 |108
 
-|<<executable-file-creation-with-multiple-extensions, Executable File Creation with Multiple Extensions>> |Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<executable-file-creation-with-multiple-extensions, Executable File Creation with Multiple Extensions>> |Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<executable-file-with-unusual-extension, Executable File with Unusual Extension>> |Identifies the creation or modification of an executable file with an unexpected file extension. Attackers may attempt to evade detection by masquerading files using the file extension values used by image, audio, or document file types. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
 |<<executable-masquerading-as-kernel-process, Executable Masquerading as Kernel Process>> |Monitors for kernel processes with associated process executable fields that are not empty. Unix kernel processes such as kthreadd and kworker typically do not have process.executable fields associated to them. Attackers may attempt to hide their malicious programs by masquerading as legitimate kernel processes. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |2
 
-|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<execution-from-unusual-directory-command-line, Execution from Unusual Directory - Command Line>> |Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<execution-from-a-removable-media-with-network-connection, Execution from a Removable Media with Network Connection>> |Identifies process execution from a removable media and by an unusual process. Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> |Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<execution-of-com-object-via-xwizard, Execution of COM object via Xwizard>> |Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<execution-of-file-written-or-modified-by-microsoft-office, Execution of File Written or Modified by Microsoft Office>> |Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<execution-of-file-written-or-modified-by-pdf-reader, Execution of File Written or Modified by PDF Reader>> |Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<execution-of-persistent-suspicious-program, Execution of Persistent Suspicious Program>> |Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<execution-of-an-unsigned-service, Execution of an Unsigned Service>> |This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |104
 
@@ -510,25 +510,25 @@ and their rule type is `machine_learning`.
 
 |<<execution-via-ms-visualstudio-pre-post-build-events, Execution via MS VisualStudio Pre/Post Build Events>> |Identifies the execution of a command via Microsoft Visual Studio Pre or Post build events. Adversaries may backdoor a trusted visual studio project to execute a malicious command during the project build process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<execution-via-mssql-xp-cmdshell-stored-procedure, Execution via MSSQL xp_cmdshell Stored Procedure>> |Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<execution-via-microsoft-dotnet-clickonce-host, Execution via Microsoft DotNet ClickOnce Host>> |Identifies the execution of DotNet ClickOnce installer via Dfsvc.exe trampoline. Adversaries may take advantage of ClickOnce to proxy execution of malicious payloads via trusted Microsoft processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<execution-via-tsclient-mountpoint, Execution via TSClient Mountpoint>> |Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<execution-via-tsclient-mountpoint, Execution via TSClient Mountpoint>> |Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<execution-via-windows-subsystem-for-linux, Execution via Windows Subsystem for Linux>> |Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
+|<<execution-via-windows-subsystem-for-linux, Execution via Windows Subsystem for Linux>> |Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
 
-|<<execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> |Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<execution-via-local-sxs-shared-module, Execution via local SxS Shared Module>> |Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<execution-with-explicit-credentials-via-scripting, Execution with Explicit Credentials via Scripting>> |Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<expired-or-revoked-driver-loaded, Expired or Revoked Driver Loaded>> |Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |4
+|<<expired-or-revoked-driver-loaded, Expired or Revoked Driver Loaded>> |Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<exploit-detected-elastic-endgame, Exploit - Detected - Elastic Endgame>> |Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |102
 
 |<<exploit-prevented-elastic-endgame, Exploit - Prevented - Elastic Endgame>> |Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<exporting-exchange-mailbox-via-powershell, Exporting Exchange Mailbox via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<exporting-exchange-mailbox-via-powershell, Exporting Exchange Mailbox via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<external-alerts, External Alerts>> |Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app. |[OS: Windows], [Data Source: APM], [OS: macOS], [OS: Linux] |8.3.0 |102
 
@@ -586,21 +586,21 @@ and their rule type is `machine_learning`.
 
 |<<first-time-seen-aws-secret-value-accessed-in-secrets-manager, First Time Seen AWS Secret Value Accessed in Secrets Manager>> |An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service may attempt to leverage the compromised service to access secrets in AWS Secrets Manager. This rule looks for the first time a specific user identity has programmatically retrieved a specific secret value from Secrets Manager using the `GetSecretValue` action.  This rule assumes that AWS services such as Lambda functions and EC2 instances are setup with IAM role's assigned that have the necessary permissions to access the secrets in Secrets Manager. An adversary with access to a compromised AWS service such as an EC2 instance, Lambda function, or other service would rely on the compromised service's IAM role to access the secrets in Secrets Manager. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Tactic: Credential Access], [Resources: Investigation Guide] |8.9.0 |309
 
-|<<first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> |Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.4.0 |4
+|<<first-time-seen-commonly-abused-remote-access-tool-execution, First Time Seen Commonly Abused Remote Access Tool Execution>> |Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.4.0 |5
 
-|<<first-time-seen-driver-loaded, First Time Seen Driver Loaded>> |Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |6
+|<<first-time-seen-driver-loaded, First Time Seen Driver Loaded>> |Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |7
 
 |<<first-time-seen-google-workspace-oauth-login-from-third-party-application, First Time Seen Google Workspace OAuth Login from Third-Party Application>> |Detects the first time a third-party application logs in and authenticated with OAuth. OAuth is used to grant permissions to specific resources and services in Google Workspace. Compromised credentials or service accounts could allow an adversary to authenticate to Google Workspace as a valid user and inherit their privileges. |[Domain: Cloud], [Data Source: Google Workspace], [Tactic: Defense Evasion], [Tactic: Initial Access] |8.4.0 |3
 
 |<<first-time-seen-newcredentials-logon-process, First Time Seen NewCredentials Logon Process>> |Identifies a new credentials logon type performed by an unusual process. This may indicate the existence of an access token forging capability that are often abused to bypass access control restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.4.0 |2
 
-|<<first-time-seen-removable-device, First Time Seen Removable Device>> |Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.4.0 |3
+|<<first-time-seen-removable-device, First Time Seen Removable Device>> |Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.4.0 |4
 
 |<<firsttime-seen-account-performing-dcsync, FirstTime Seen Account Performing DCSync>> |This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Resources: Investigation Guide] |8.4.0 |10
 
 |<<forwarded-google-workspace-security-alert, Forwarded Google Workspace Security Alert>> |Identifies the occurrence of a security alert from the Google Workspace alerts center. Google Workspace's security alert center provides an overview of actionable alerts that may be affecting an organization's domain. An alert is a warning of a potential security issue that Google has detected. |[Domain: Cloud], [Data Source: Google Workspace], [Use Case: Log Auditing], [Use Case: Threat Detection] |8.4.0 |2
 
-|<<full-user-mode-dumps-enabled-system-wide, Full User-Mode Dumps Enabled System-Wide>> |Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Sysmon] |8.3.0 |6
+|<<full-user-mode-dumps-enabled-system-wide, Full User-Mode Dumps Enabled System-Wide>> |Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Sysmon] |8.3.0 |7
 
 |<<gcp-firewall-rule-creation, GCP Firewall Rule Creation>> |Identifies when a firewall rule is created in Google Cloud Platform (GCP) for Virtual Private Cloud (VPC) or App Engine. These firewall rules can be configured to allow or deny connections to or from virtual machine (VM) instances or specific applications. An adversary may create a new firewall rule in order to weaken their target's security controls and allow more permissive ingress or egress traffic flows for their benefit. |[Domain: Cloud], [Data Source: GCP], [Data Source: Google Cloud Platform], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |104
 
@@ -698,7 +698,7 @@ and their rule type is `machine_learning`.
 
 |<<group-policy-abuse-for-privilege-addition, Group Policy Abuse for Privilege Addition>> |Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |109
 
-|<<group-policy-discovery-via-microsoft-gpresult-utility, Group Policy Discovery via Microsoft GPResult Utility>> |Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |7
+|<<group-policy-discovery-via-microsoft-gpresult-utility, Group Policy Discovery via Microsoft GPResult Utility>> |Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |8
 
 |<<halfbaked-command-and-control-beacon, Halfbaked Command and Control Beacon>> |Halfbaked is a malware family used to establish persistence in a contested network. This rule detects a network activity algorithm leveraged by Halfbaked implant beacons for command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |104
 
@@ -714,7 +714,7 @@ and their rule type is `machine_learning`.
 
 |<<high-number-of-process-terminations, High Number of Process Terminations>> |This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |112
 
-|<<high-number-of-process-and-or-service-terminations, High Number of Process and/or Service Terminations>> |This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<high-number-of-process-and-or-service-terminations, High Number of Process and/or Service Terminations>> |This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<high-variance-in-rdp-session-duration, High Variance in RDP Session Duration>> |A machine learning job has detected unusually high variance of RDP session duration. Long RDP sessions can be used to evade detection mechanisms via session persistence, and might be used to perform tasks such as lateral movement, that might require uninterrupted access to a compromised machine. |[Use Case: Lateral Movement Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Lateral Movement] |8.9.0 |3
 
@@ -724,15 +724,15 @@ and their rule type is `machine_learning`.
 
 |<<hping-process-activity, Hping Process Activity>> |Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |108
 
-|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<iis-http-logging-disabled, IIS HTTP Logging Disabled>> |Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<ipsec-nat-traversal-port-activity, IPSEC NAT Traversal Port Activity>> |This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection] |8.3.0 |104
 
-|<<image-file-execution-options-injection, Image File Execution Options Injection>> |The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<image-file-execution-options-injection, Image File Execution Options Injection>> |The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<image-loaded-with-invalid-signature, Image Loaded with Invalid Signature>> |Identifies binaries that are loaded and with an invalid code signature. This may indicate an attempt to masquerade as a signed binary. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> |Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<imageload-via-windows-update-auto-update-client, ImageLoad via Windows Update Auto Update Client>> |Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<inbound-connection-to-an-unsecure-elasticsearch-node, Inbound Connection to an Unsecure Elasticsearch Node>> |Identifies Elasticsearch nodes that do not have Transport Layer Security (TLS), and/or lack authentication, and are accepting inbound network connections over the default Elasticsearch port. |[Use Case: Threat Detection], [Tactic: Initial Access], [Domain: Endpoint] |8.3.0 |104
 
@@ -748,15 +748,15 @@ and their rule type is `machine_learning`.
 
 |<<indirect-command-execution-via-forfiles-pcalua, Indirect Command Execution via Forfiles/Pcalua>> |Identifies indirect command execution via Program Compatibility Assistant (pcalua.exe) or forfiles.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<ingress-transfer-via-windows-bits, Ingress Transfer via Windows BITS>> |Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |6
+|<<ingress-transfer-via-windows-bits, Ingress Transfer via Windows BITS>> |Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.3.0 |7
 
 |<<installutil-activity, InstallUtil Activity>> |InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. Adversaries may use InstallUtil to proxy the execution of code through a trusted Windows utility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
 |<<installutil-process-making-network-connections, InstallUtil Process Making Network Connections>> |Identifies InstallUtil.exe making outbound network connections. This may indicate adversarial activity as InstallUtil is often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
 
-|<<installation-of-custom-shim-databases, Installation of Custom Shim Databases>> |Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<installation-of-custom-shim-databases, Installation of Custom Shim Databases>> |Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<installation-of-security-support-provider, Installation of Security Support Provider>> |Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<installation-of-security-support-provider, Installation of Security Support Provider>> |Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<interactive-exec-command-launched-against-a-running-container, Interactive Exec Command Launched Against A Running Container>> |This rule detects interactive 'exec' events launched against a container using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/command inside the container. This rule specifically targets higher-risk interactive commands that allow real-time interaction with a container's shell. A malicious actor could use this level of access to further compromise the container environment or attempt a container breakout. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
@@ -772,7 +772,7 @@ and their rule type is `machine_learning`.
 
 |<<kerberos-pre-authentication-disabled-for-user, Kerberos Pre-authentication Disabled for User>> |Identifies the modification of an account's Kerberos pre-authentication options. An adversary with GenericWrite/GenericAll rights over the account can maliciously modify these settings to perform offline password cracking attacks such as AS-REP roasting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |110
 
-|<<kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> |Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<kerberos-traffic-from-unusual-process, Kerberos Traffic from Unusual Process>> |Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<kernel-driver-load, Kernel Driver Load>> |Detects the loading of a Linux kernel module through system calls. Threat actors may leverage Linux kernel modules to load a rootkit on a system providing them with complete control and the ability to hide from security products. As other rules monitor for the addition of Linux kernel modules through system utilities or .ko files, this rule covers the gap that evasive rootkits leverage by monitoring for kernel module additions on the lowest level through auditd_manager. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion] |8.3.0 |4
 
@@ -786,7 +786,7 @@ and their rule type is `machine_learning`.
 
 |<<keychain-password-retrieval-via-command-line, Keychain Password Retrieval via Command Line>> |Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<kirbi-file-creation, Kirbi File Creation>> |Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |4
+|<<kirbi-file-creation, Kirbi File Creation>> |Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |5
 
 |<<kubernetes-anonymous-request-authorized, Kubernetes Anonymous Request Authorized>> |This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously. |[Data Source: Kubernetes], [Tactic: Execution], [Tactic: Initial Access], [Tactic: Defense Evasion] |8.4.0 |6
 
@@ -812,19 +812,19 @@ and their rule type is `machine_learning`.
 
 |<<kubernetes-user-exec-into-pod, Kubernetes User Exec into Pod>> |This rule detects a user attempt to establish a shell session into a pod using the 'exec' command. Using the 'exec' command in a pod allows a user to establish a temporary shell session and execute any process/commands in the pod. An adversary may call bash to gain a persistent interactive shell which will allow access to any data the pod has permissions to, including secrets. |[Data Source: Kubernetes], [Tactic: Execution] |8.4.0 |203
 
-|<<lsass-memory-dump-creation, LSASS Memory Dump Creation>> |Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<lsass-memory-dump-creation, LSASS Memory Dump Creation>> |Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<lsass-memory-dump-handle-access, LSASS Memory Dump Handle Access>> |Identifies handle requests for the Local Security Authority Subsystem Service (LSASS) object access with specific access masks that many tools with a capability to dump memory to disk use (0x1fffff, 0x1010, 0x120089). This rule is tool agnostic as it has been validated against a host of various LSASS dump tools such as SharpDump, Procdump, Mimikatz, Comsvcs etc. It detects this behavior at a low level and does not depend on a specific tool or dump file name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |110
 
-|<<lsass-process-access-via-windows-api, LSASS Process Access via Windows API>> |Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Execution], [Data Source: Elastic Defend] |8.7.0 |6
+|<<lsass-process-access-via-windows-api, LSASS Process Access via Windows API>> |Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Execution], [Data Source: Elastic Defend] |8.7.0 |7
 
-|<<lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> |Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<lateral-movement-via-startup-folder, Lateral Movement via Startup Folder>> |Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<launch-agent-creation-or-modification-and-immediate-loading, Launch Agent Creation or Modification and Immediate Loading>> |An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<launchdaemon-creation-or-modification-and-immediate-loading, LaunchDaemon Creation or Modification and Immediate Loading>> |Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<linux-group-creation, Linux Group Creation>> |Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |4
+|<<linux-group-creation, Linux Group Creation>> |Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |5
 
 |<<linux-process-hooking-via-gdb, Linux Process Hooking via GDB>> |This rule monitors for potential memory dumping through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |3
 
@@ -832,15 +832,15 @@ and their rule type is `machine_learning`.
 
 |<<linux-system-information-discovery, Linux System Information Discovery>> |Enrich process events with uname and other command lines that imply Linux system information discovery. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |3
 
-|<<linux-user-account-creation, Linux User Account Creation>> |Identifies attempts to create new users. Attackers may add new users to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |4
+|<<linux-user-account-creation, Linux User Account Creation>> |Identifies attempts to create new users. Attackers may add new users to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |5
 
 |<<linux-user-added-to-privileged-group, Linux User Added to Privileged Group>> |Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |6
 
 |<<linux-init-pid-1-secret-dump-via-gdb, Linux init (PID 1) Secret Dump via GDB>> |This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include "truffleproc" and "bash-memory-dump". This behavior should not happen by default, and should be investigated thoroughly. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |6
 
-|<<local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> |Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |7
+|<<local-account-tokenfilter-policy-disabled, Local Account TokenFilter Policy Disabled>> |Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |8
 
-|<<local-scheduled-task-creation, Local Scheduled Task Creation>> |Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<local-scheduled-task-creation, Local Scheduled Task Creation>> |Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<mfa-deactivation-with-no-re-activation-for-okta-user-account, MFA Deactivation with no Re-Activation for Okta User Account>> |Detects multi-factor authentication (MFA) deactivation with no subsequent re-activation for an Okta user account. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account. |[Tactic: Persistence], [Use Case: Identity and Access Audit], [Data Source: Okta], [Domain: Cloud] |8.10.0 |207
 
@@ -856,9 +856,9 @@ and their rule type is `machine_learning`.
 
 |<<machine-learning-detected-a-dns-request-with-a-high-dga-probability-score, Machine Learning Detected a DNS Request With a High DGA Probability Score>> |A supervised machine learning model has identified a DNS question name with a high probability of sourcing from a Domain Generation Algorithm (DGA), which could indicate command and control network activity. |[Domain: Network], [Domain: Endpoint], [Data Source: Elastic Defend], [Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.9.0 |3
 
-|<<machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity, Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity, Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score, Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score>> |A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity. Alternatively, the model's blocklist identified the event as being malicious. |[OS: Windows], [Data Source: Elastic Endgame], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
 |<<malware-detected-elastic-endgame, Malware - Detected - Elastic Endgame>> |Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame] |8.3.0 |102
 
@@ -870,77 +870,77 @@ and their rule type is `machine_learning`.
 
 |<<memory-dump-file-with-unusual-extension, Memory Dump File with Unusual Extension>> |Identifies the creation of a memory dump file with an unusual extension, which can indicate an attempt to disguise a memory dump as another file type to bypass security defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<microsoft-365-exchange-anti-phish-policy-deletion, Microsoft 365 Exchange Anti-Phish Policy Deletion>> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |105
+|<<microsoft-365-exchange-anti-phish-policy-deletion, Microsoft 365 Exchange Anti-Phish Policy Deletion>> |Identifies the deletion of an anti-phishing policy in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing polices increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.8.0 |206
 
-|<<microsoft-365-exchange-anti-phish-rule-modification, Microsoft 365 Exchange Anti-Phish Rule Modification>> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |105
+|<<microsoft-365-exchange-anti-phish-rule-modification, Microsoft 365 Exchange Anti-Phish Rule Modification>> |Identifies the modification of an anti-phishing rule in Microsoft 365. By default, Microsoft 365 includes built-in features that help protect users from phishing attacks. Anti-phishing rules increase this protection by refining settings to better detect and prevent attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.8.0 |206
 
-|<<microsoft-365-exchange-dkim-signing-configuration-disabled, Microsoft 365 Exchange DKIM Signing Configuration Disabled>> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Persistence] |8.3.0 |105
+|<<microsoft-365-exchange-dkim-signing-configuration-disabled, Microsoft 365 Exchange DKIM Signing Configuration Disabled>> |Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is disabled in Microsoft 365. With DKIM in Microsoft 365, messages that are sent from Exchange Online will be cryptographically signed. This will allow the receiving email system to validate that the messages were generated by a server that the organization authorized and were not spoofed. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Persistence] |8.8.0 |206
 
-|<<microsoft-365-exchange-dlp-policy-removed, Microsoft 365 Exchange DLP Policy Removed>> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |105
+|<<microsoft-365-exchange-dlp-policy-removed, Microsoft 365 Exchange DLP Policy Removed>> |Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365. An adversary may remove a DLP policy to evade existing DLP monitoring. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.8.0 |206
 
-|<<microsoft-365-exchange-malware-filter-policy-deletion, Microsoft 365 Exchange Malware Filter Policy Deletion>> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |105
+|<<microsoft-365-exchange-malware-filter-policy-deletion, Microsoft 365 Exchange Malware Filter Policy Deletion>> |Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert administrators that an internal user sent a message that contained malware. This may indicate an account or machine compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.8.0 |206
 
-|<<microsoft-365-exchange-malware-filter-rule-modification, Microsoft 365 Exchange Malware Filter Rule Modification>> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |105
+|<<microsoft-365-exchange-malware-filter-rule-modification, Microsoft 365 Exchange Malware Filter Rule Modification>> |Identifies when a malware filter rule has been deleted or disabled in Microsoft 365. An adversary or insider threat may want to modify a malware filter rule to evade detection. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.8.0 |206
 
-|<<microsoft-365-exchange-management-group-role-assignment, Microsoft 365 Exchange Management Group Role Assignment>> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |105
+|<<microsoft-365-exchange-management-group-role-assignment, Microsoft 365 Exchange Management Group Role Assignment>> |Identifies when a new role is assigned to a management group in Microsoft 365. An adversary may attempt to add a role in order to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.8.0 |206
 
-|<<microsoft-365-exchange-safe-attachment-rule-disabled, Microsoft 365 Exchange Safe Attachment Rule Disabled>> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.3.0 |105
+|<<microsoft-365-exchange-safe-attachment-rule-disabled, Microsoft 365 Exchange Safe Attachment Rule Disabled>> |Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attachment rules can extend malware protections to include routing all messages and attachments without a known malware signature to a special hypervisor environment. An adversary or insider threat may disable a safe attachment rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Defense Evasion] |8.8.0 |206
 
-|<<microsoft-365-exchange-safe-link-policy-disabled, Microsoft 365 Exchange Safe Link Policy Disabled>> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.3.0 |105
+|<<microsoft-365-exchange-safe-link-policy-disabled, Microsoft 365 Exchange Safe Link Policy Disabled>> |Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link policies for Office applications extend phishing protection to documents that contain hyperlinks, even after they have been delivered to a user. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Initial Access] |8.8.0 |206
 
-|<<microsoft-365-exchange-transport-rule-creation, Microsoft 365 Exchange Transport Rule Creation>> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.3.0 |105
+|<<microsoft-365-exchange-transport-rule-creation, Microsoft 365 Exchange Transport Rule Creation>> |Identifies a transport rule creation in Microsoft 365. As a best practice, Exchange Online mail transport rules should not be set to forward email to domains outside of your organization. An adversary may create transport rules to exfiltrate data. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.8.0 |206
 
-|<<microsoft-365-exchange-transport-rule-modification, Microsoft 365 Exchange Transport Rule Modification>> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.3.0 |105
+|<<microsoft-365-exchange-transport-rule-modification, Microsoft 365 Exchange Transport Rule Modification>> |Identifies when a transport rule has been disabled or deleted in Microsoft 365. Mail flow rules (also known as transport rules) are used to identify and take action on messages that flow through your organization. An adversary or insider threat may modify a transport rule to exfiltrate data or evade defenses. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |8.8.0 |206
 
-|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.3.0 |105
+|<<microsoft-365-global-administrator-role-assigned, Microsoft 365 Global Administrator Role Assigned>> |In Azure Active Directory (Azure AD), permissions to manage resources are assigned using roles. The Global Administrator is a role that enables users to have access to all administrative features in Azure AD and services that use Azure AD identities like the Microsoft 365 Defender portal, the Microsoft 365 compliance center, Exchange, SharePoint Online, and Skype for Business Online. Attackers can add users as Global Administrators to maintain access and manage all subscriptions and their settings and resources. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Persistence] |8.8.0 |206
 
 |<<microsoft-365-impossible-travel-activity, Microsoft 365 Impossible travel activity>> |Identifies when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |None |1
 
-|<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Collection] |8.3.0 |105
+|<<microsoft-365-inbox-forwarding-rule-created, Microsoft 365 Inbox Forwarding Rule Created>> |Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox rules process messages in the Inbox based on conditions and take actions. In this case, the rules will forward the emails to a defined address. Attackers can abuse Inbox Rules to intercept and exfiltrate email data without making organization-wide configuration changes or having the corresponding privileges. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Collection] |8.8.0 |206
 
 |<<microsoft-365-mass-download-by-a-single-user, Microsoft 365 Mass download by a single user>> |Identifies when Microsoft Cloud App Security reports that a single user performs more than 50 downloads within 1 minute. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Exfiltration] |None |1
 
-|<<microsoft-365-potential-ransomware-activity, Microsoft 365 Potential ransomware activity>> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.3.0 |105
+|<<microsoft-365-potential-ransomware-activity, Microsoft 365 Potential ransomware activity>> |Identifies when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that might be infected with ransomware. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.8.0 |206
 
-|<<microsoft-365-teams-custom-application-interaction-allowed, Microsoft 365 Teams Custom Application Interaction Allowed>> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |106
+|<<microsoft-365-teams-custom-application-interaction-allowed, Microsoft 365 Teams Custom Application Interaction Allowed>> |Identifies when custom applications are allowed in Microsoft Teams. If an organization requires applications other than those available in the Teams app store, custom applications can be developed as packages and uploaded. An adversary may abuse this behavior to establish persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.8.0 |207
 
-|<<microsoft-365-teams-external-access-enabled, Microsoft 365 Teams External Access Enabled>> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |105
+|<<microsoft-365-teams-external-access-enabled, Microsoft 365 Teams External Access Enabled>> |Identifies when external access is enabled in Microsoft Teams. External access lets Teams and Skype for Business users communicate with other users that are outside their organization. An adversary may enable external access or add an allowed domain to exfiltrate data or maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.8.0 |206
 
-|<<microsoft-365-teams-guest-access-enabled, Microsoft 365 Teams Guest Access Enabled>> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |105
+|<<microsoft-365-teams-guest-access-enabled, Microsoft 365 Teams Guest Access Enabled>> |Identifies when guest access is enabled in Microsoft Teams. Guest access in Teams allows people outside the organization to access teams and channels. An adversary may enable guest access to maintain persistence in an environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.8.0 |206
 
-|<<microsoft-365-unusual-volume-of-file-deletion, Microsoft 365 Unusual Volume of File Deletion>> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.3.0 |105
+|<<microsoft-365-unusual-volume-of-file-deletion, Microsoft 365 Unusual Volume of File Deletion>> |Identifies that a user has deleted an unusually large volume of files as reported by Microsoft Cloud App Security. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Impact] |8.8.0 |206
 
-|<<microsoft-365-user-restricted-from-sending-email, Microsoft 365 User Restricted from Sending Email>> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |105
+|<<microsoft-365-user-restricted-from-sending-email, Microsoft 365 User Restricted from Sending Email>> |Identifies when a user has been restricted from sending email due to exceeding sending limits of the service policies per the Security Compliance Center. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.8.0 |206
 
-|<<microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.6.0 |210
+|<<microsoft-build-engine-started-an-unusual-process, Microsoft Build Engine Started an Unusual Process>> |An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.6.0 |211
 
-|<<microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.6.0 |208
+|<<microsoft-build-engine-started-by-a-script-process, Microsoft Build Engine Started by a Script Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.6.0 |209
 
-|<<microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<microsoft-build-engine-started-by-a-system-process, Microsoft Build Engine Started by a System Process>> |An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> |An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<microsoft-build-engine-started-by-an-office-application, Microsoft Build Engine Started by an Office Application>> |An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
+|<<microsoft-build-engine-using-an-alternate-name, Microsoft Build Engine Using an Alternate Name>> |An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |112
 
-|<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |108
+|<<microsoft-exchange-server-um-spawning-suspicious-processes, Microsoft Exchange Server UM Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<microsoft-exchange-server-um-writing-suspicious-files, Microsoft Exchange Server UM Writing Suspicious Files>> |Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<microsoft-exchange-transport-agent-install-script, Microsoft Exchange Transport Agent Install Script>> |Identifies the use of Cmdlets and methods related to Microsoft Exchange Transport Agents install. Adversaries may leverage malicious Microsoft Exchange Transport Agents to execute tasks in response to adversary-defined criteria, establishing persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |4
 
-|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<microsoft-exchange-worker-spawning-suspicious-processes, Microsoft Exchange Worker Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<microsoft-iis-connection-strings-decryption, Microsoft IIS Connection Strings Decryption>> |Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<microsoft-iis-service-account-password-dumped, Microsoft IIS Service Account Password Dumped>> |Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<microsoft-windows-defender-tampering, Microsoft Windows Defender Tampering>> |Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<microsoft-windows-defender-tampering, Microsoft Windows Defender Tampering>> |Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<mimikatz-memssp-log-file-detected, Mimikatz Memssp Log File Detected>> |Identifies the password log file from the default Mimikatz memssp module. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<mimikatz-memssp-log-file-detected, Mimikatz Memssp Log File Detected>> |Identifies the password log file from the default Mimikatz memssp module. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<modification-of-amsienable-registry-key, Modification of AmsiEnable Registry Key>> |Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<modification-of-amsienable-registry-key, Modification of AmsiEnable Registry Key>> |Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<modification-of-boot-configuration, Modification of Boot Configuration>> |Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<modification-of-boot-configuration, Modification of Boot Configuration>> |Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<modification-of-dynamic-linker-preload-shared-object, Modification of Dynamic Linker Preload Shared Object>> |Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |209
 
@@ -954,7 +954,7 @@ and their rule type is `machine_learning`.
 
 |<<modification-of-standard-authentication-module-or-configuration, Modification of Standard Authentication Module or Configuration>> |Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges. |[Domain: Endpoint], [OS: macOS], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Data Source: Elastic Defend] |8.6.0 |204
 
-|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<modification-of-wdigest-security-provider, Modification of WDigest Security Provider>> |Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<modification-of-the-mspkiaccountcredentials, Modification of the msPKIAccountCredentials>> |Identify the modification of the msPKIAccountCredentials attribute in an Active Directory User Object. Attackers can abuse the credentials roaming feature to overwrite an arbitrary file for privilege escalation. ms-PKI-AccountCredentials contains binary large objects (BLOBs) of encrypted credential objects from the credential manager store, private keys, certificates, and certificate requests. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Data Source: Active Directory], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring] |8.3.0 |9
 
@@ -964,7 +964,7 @@ and their rule type is `machine_learning`.
 
 |<<mount-launched-inside-a-privileged-container, Mount Launched Inside a Privileged Container>> |This rule detects the use of the mount utility from inside a privileged container. The mount command is used to make a device or file system accessible to the system, and then to connect its root directory to a specified mount point on the local file system. When launched inside a privileged container--a container deployed with all the capabilities of the host machine-- an attacker can access sensitive host level files which could be used for further privilege escalation and container escapes to the host machine. Any usage of mount inside a running privileged container should be further investigated. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.10.0 |1
 
-|<<mounting-hidden-or-webdav-remote-shares, Mounting Hidden or WebDav Remote Shares>> |Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<mounting-hidden-or-webdav-remote-shares, Mounting Hidden or WebDav Remote Shares>> |Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<msbuild-making-network-connections, MsBuild Making Network Connections>> |Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
@@ -990,7 +990,7 @@ and their rule type is `machine_learning`.
 
 |<<my-first-rule, My First Rule>> |This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity. |[Use Case: Guided Onboarding] |8.7.0 |3
 
-|<<ntds-or-sam-database-file-copied, NTDS or SAM Database File Copied>> |Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<ntds-or-sam-database-file-copied, NTDS or SAM Database File Copied>> |Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<namespace-manipulation-using-unshare, Namespace Manipulation Using Unshare>> |Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |9
 
@@ -1018,7 +1018,7 @@ and their rule type is `machine_learning`.
 
 |<<network-connection-via-signed-binary, Network Connection via Signed Binary>> |Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<network-logon-provider-registry-modification, Network Logon Provider Registry Modification>> |Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<network-logon-provider-registry-modification, Network Logon Provider Registry Modification>> |Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<network-traffic-capture-via-cap-net-raw, Network Traffic Capture via CAP_NET_RAW>> |Identifies the ability of a process to be able to create RAW and PACKET socket types for the available network namespaces by a non-root user. A malicious process with this capability may exploit routing between hosts, bypass network access controls, and otherwise tamper with host networking if a firewall is not in place to limit the packet types and contents. The CAP_NET_RAW capability allows the process to bind to any address within the available namespaces, which allows network traffic sniffing by a non root user. The rule identifies previously unknown processes executing with CAP_NET_RAW capabilities through the use of the new terms rule type. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.11.0 |2
 
@@ -1026,7 +1026,7 @@ and their rule type is `machine_learning`.
 
 |<<network-level-authentication-nla-disabled, Network-Level Authentication (NLA) Disabled>> |Identifies the attempt to disable Network-Level Authentication (NLA) via registry modification. Network Level Authentication (NLA) is a feature on Windows that provides an extra layer of security for Remote Desktop (RDP) connections, as it requires users to authenticate before allowing a full RDP session. Attackers can disable NLA to enable persistence methods that require access to the Windows sign-in screen without authenticating, such as Accessibility Features persistence methods, like Sticky Keys. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |2
 
-|<<new-activesyncalloweddeviceid-added-via-powershell, New ActiveSyncAllowedDeviceID Added via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<new-activesyncalloweddeviceid-added-via-powershell, New ActiveSyncAllowedDeviceID Added via PowerShell>> |Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<new-github-app-installed, New GitHub App Installed>> |This rule detects when a new GitHub App has been installed in your organization account. GitHub Apps extend GitHub's functionality both within and outside of GitHub. When an app is installed it is granted permissions to read or modify your repository and organization data. Only trusted apps should be installed and any newly installed apps should be investigated to verify their legitimacy. Unauthorized app installation could lower your organization's security posture and leave you exposed for future attacks. |[Domain: Cloud], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Github] |8.3.0 |1
 
@@ -1042,19 +1042,19 @@ and their rule type is `machine_learning`.
 
 |<<new-user-added-to-github-organization, New User Added To GitHub Organization>> |A new user was added to a GitHub organization. |[Domain: Cloud], [Use Case: Threat Detection], [Use Case: UEBA], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Github] |8.3.0 |1
 
-|<<new-or-modified-federation-domain, New or Modified Federation Domain>> |Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.3.0 |105
+|<<new-or-modified-federation-domain, New or Modified Federation Domain>> |Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Privilege Escalation] |8.8.0 |206
 
 |<<nping-process-activity, Nping Process Activity>> |Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |108
 
-|<<nullsessionpipe-registry-modification, NullSessionPipe Registry Modification>> |Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<nullsessionpipe-registry-modification, NullSessionPipe Registry Modification>> |Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<o365-email-reported-by-user-as-malware-or-phish, O365 Email Reported by User as Malware or Phish>> |Detects the occurrence of emails reported as Phishing or Malware by Users. Security Awareness training is essential to stay ahead of scammers and threat actors, as security products can be bypassed, and the user can still receive a malicious message. Educating users to report suspicious messages can help identify gaps in security controls and prevent malware infections and Business Email Compromise attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access] |8.3.0 |105
+|<<o365-email-reported-by-user-as-malware-or-phish, O365 Email Reported by User as Malware or Phish>> |Detects the occurrence of emails reported as Phishing or Malware by Users. Security Awareness training is essential to stay ahead of scammers and threat actors, as security products can be bypassed, and the user can still receive a malicious message. Educating users to report suspicious messages can help identify gaps in security controls and prevent malware infections and Business Email Compromise attacks. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access] |8.8.0 |206
 
-|<<o365-excessive-single-sign-on-logon-errors, O365 Excessive Single Sign-On Logon Errors>> |Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |106
+|<<o365-excessive-single-sign-on-logon-errors, O365 Excessive Single Sign-On Logon Errors>> |Identifies accounts with a high number of single sign-on (SSO) logon errors. Excessive logon errors may indicate an attempt to brute force a password or SSO token. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.8.0 |207
 
-|<<o365-exchange-suspicious-mailbox-right-delegation, O365 Exchange Suspicious Mailbox Right Delegation>> |Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can evade spam/phishing detection mechanisms. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |105
+|<<o365-exchange-suspicious-mailbox-right-delegation, O365 Exchange Suspicious Mailbox Right Delegation>> |Identifies the assignment of rights to access content from another mailbox. An adversary may use the compromised account to send messages to other accounts in the network of the target organization while creating inbox rules, so messages can evade spam/phishing detection mechanisms. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Persistence] |8.8.0 |206
 
-|<<o365-mailbox-audit-logging-bypass, O365 Mailbox Audit Logging Bypass>> |Detects the occurrence of mailbox audit bypass associations. The mailbox audit is responsible for logging specified mailbox events (like accessing a folder or a message or permanently deleting a message). However, actions taken by some authorized accounts, such as accounts used by third-party tools or accounts used for lawful monitoring, can create a large number of mailbox audit log entries and may not be of interest to your organization. Because of this, administrators can create bypass associations, allowing certain accounts to perform their tasks without being logged. Attackers can abuse this allowlist mechanism to conceal actions taken, as the mailbox audit will log no activity done by the account. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access], [Tactic: Defense Evasion] |8.3.0 |105
+|<<o365-mailbox-audit-logging-bypass, O365 Mailbox Audit Logging Bypass>> |Detects the occurrence of mailbox audit bypass associations. The mailbox audit is responsible for logging specified mailbox events (like accessing a folder or a message or permanently deleting a message). However, actions taken by some authorized accounts, such as accounts used by third-party tools or accounts used for lawful monitoring, can create a large number of mailbox audit log entries and may not be of interest to your organization. Because of this, administrators can create bypass associations, allowing certain accounts to perform their tasks without being logged. Attackers can abuse this allowlist mechanism to conceal actions taken, as the mailbox audit will log no activity done by the account. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Initial Access], [Tactic: Defense Evasion] |8.8.0 |206
 
 |<<office-test-registry-persistence, Office Test Registry Persistence>> |Identifies the modification of the Microsoft Office "Office Test" Registry key, a registry location that can be used to specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain persistence on a compromised host. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |2
 
@@ -1070,19 +1070,19 @@ and their rule type is `machine_learning`.
 
 |<<okta-user-sessions-started-from-different-geolocations, Okta User Sessions Started from Different Geolocations>> |Detects when a specific Okta actor has multiple sessions started from different geolocations. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.10.0 |1
 
-|<<onedrive-malware-file-upload, OneDrive Malware File Upload>> |Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.3.0 |105
+|<<onedrive-malware-file-upload, OneDrive Malware File Upload>> |Identifies the occurence of files uploaded to OneDrive being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunity to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.8.0 |206
 
-|<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<outbound-scheduled-task-activity-via-powershell, Outbound Scheduled Task Activity via PowerShell>> |Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<parent-process-pid-spoofing, Parent Process PID Spoofing>> |Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |105
+|<<parent-process-pid-spoofing, Parent Process PID Spoofing>> |Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<peripheral-device-discovery, Peripheral Device Discovery>> |Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<peripheral-device-discovery, Peripheral Device Discovery>> |Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<permission-theft-detected-elastic-endgame, Permission Theft - Detected - Elastic Endgame>> |Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
 |<<permission-theft-prevented-elastic-endgame, Permission Theft - Prevented - Elastic Endgame>> |Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
-|<<persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> |An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<persistence-via-bits-job-notify-cmdline, Persistence via BITS Job Notify Cmdline>> |An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<persistence-via-directoryservice-plugin-modification, Persistence via DirectoryService Plugin Modification>> |Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -1090,43 +1090,45 @@ and their rule type is `machine_learning`.
 
 |<<persistence-via-folder-action-script, Persistence via Folder Action Script>> |Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> |Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<persistence-via-hidden-run-key-detected, Persistence via Hidden Run Key Detected>> |Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<persistence-via-kde-autostart-script-or-desktop-file-modification, Persistence via KDE AutoStart Script or Desktop File Modification>> |Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<persistence-via-login-or-logout-hook, Persistence via Login or Logout Hook>> |Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> |Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<persistence-via-microsoft-office-addins, Persistence via Microsoft Office AddIns>> |Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<persistence-via-microsoft-outlook-vba, Persistence via Microsoft Outlook VBA>> |Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<persistence-via-microsoft-outlook-vba, Persistence via Microsoft Outlook VBA>> |Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<persistence-via-powershell-profile, Persistence via PowerShell profile>> |Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |8
+|<<persistence-via-powershell-profile, Persistence via PowerShell profile>> |Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |9
 
-|<<persistence-via-scheduled-job-creation, Persistence via Scheduled Job Creation>> |A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<persistence-via-scheduled-job-creation, Persistence via Scheduled Job Creation>> |A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<persistence-via-telemetrycontroller-scheduled-task-hijack, Persistence via TelemetryController Scheduled Task Hijack>> |Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<persistence-via-telemetrycontroller-scheduled-task-hijack, Persistence via TelemetryController Scheduled Task Hijack>> |Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<persistence-via-update-orchestrator-service-hijack, Persistence via Update Orchestrator Service Hijack>> |Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<persistence-via-update-orchestrator-service-hijack, Persistence via Update Orchestrator Service Hijack>> |Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<persistence-via-wmi-event-subscription, Persistence via WMI Event Subscription>> |An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<persistence-via-wmi-event-subscription, Persistence via WMI Event Subscription>> |An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<persistence-via-wmi-standard-registry-provider, Persistence via WMI Standard Registry Provider>> |Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |107
+|<<persistence-via-wmi-standard-registry-provider, Persistence via WMI Standard Registry Provider>> |Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<persistent-scripts-in-the-startup-directory, Persistent Scripts in the Startup Directory>> |Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<persistent-scripts-in-the-startup-directory, Persistent Scripts in the Startup Directory>> |Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
-|<<port-forwarding-rule-addition, Port Forwarding Rule Addition>> |Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<port-forwarding-rule-addition, Port Forwarding Rule Addition>> |Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<possible-consent-grant-attack-via-azure-registered-application, Possible Consent Grant Attack via Azure-Registered Application>> |Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |109
+|<<possible-consent-grant-attack-via-azure-registered-application, Possible Consent Grant Attack via Azure-Registered Application>> |Detects when a user grants permissions to an Azure-registered application or when an administrator grants tenant-wide permissions to an application. An adversary may create an Azure-registered application that requests access to data such as contact information, email, or documents. |[Domain: Cloud], [Data Source: Azure], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Resources: Investigation Guide], [Tactic: Initial Access] |8.3.0 |111
 
 |<<possible-fin7-dga-command-and-control-behavior, Possible FIN7 DGA Command and Control Behavior>> |This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |105
 
 |<<possible-okta-dos-attack, Possible Okta DoS Attack>> |Detects possible Denial of Service (DoS) attacks against an Okta organization. An adversary may attempt to disrupt an organization's business operations by performing a DoS attack against its Okta service. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Impact] |8.10.0 |205
 
+|<<potential-adidns-poisoning-via-wildcard-record-creation, Potential ADIDNS Poisoning via Wildcard Record Creation>> |Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS spoofing. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Use Case: Active Directory Monitoring] |8.3.0 |1
+
 |<<potential-admin-group-account-addition, Potential Admin Group Account Addition>> |Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<potential-antimalware-scan-interface-bypass-via-powershell, Potential Antimalware Scan Interface Bypass via PowerShell>> |Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |8
 
-|<<potential-application-shimming-via-sdbinst, Potential Application Shimming via Sdbinst>> |The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<potential-application-shimming-via-sdbinst, Potential Application Shimming via Sdbinst>> |The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<potential-buffer-overflow-attack-detected, Potential Buffer Overflow Attack Detected>> |Detects potential buffer overflow attacks by querying the "Segfault Detected" pre-built rule signal index, through a threshold rule, with a minimum number of 100 segfault alerts in a short timespan. A large amount of segfaults in a short time interval could indicate application exploitation attempts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Initial Access], [Use Case: Vulnerability], [Rule Type: Higher-Order Rule] |8.3.0 |2
 
@@ -1154,17 +1156,17 @@ and their rule type is `machine_learning`.
 
 |<<potential-credential-access-via-trusted-developer-utility, Potential Credential Access via Trusted Developer Utility>> |An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<potential-credential-access-via-windows-utilities, Potential Credential Access via Windows Utilities>> |Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<potential-cross-site-scripting-xss, Potential Cross Site Scripting (XSS)>> |Cross-Site Scripting (XSS) is a type of attack in which malicious scripts are injected into trusted websites. In XSS attacks, an attacker uses a benign web application to send malicious code, generally in the form of a browser-side script. This detection rule identifies the potential malicious executions of such browser-side scripts. |[Data Source: APM], [Use Case: Threat Detection], [Tactic: Initial Access] |8.3.0 |1
 
 |<<potential-dga-activity, Potential DGA Activity>> |A population analysis machine learning job detected potential DGA (domain generation algorithm) activity. Such activity is often used by malware command and control (C2) channels. This machine learning job looks for a source IP address making DNS requests that have an aggregate high probability of being DGA activity. |[Use Case: Domain Generation Algorithm Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Command and Control] |8.9.0 |3
 
-|<<potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> |Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<potential-dll-side-loading-via-microsoft-antimalware-service-executable, Potential DLL Side-Loading via Microsoft Antimalware Service Executable>> |Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<potential-dll-side-loading-via-trusted-microsoft-programs, Potential DLL Side-Loading via Trusted Microsoft Programs>> |Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<potential-dns-tunneling-via-nslookup, Potential DNS Tunneling via NsLookup>> |This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<potential-data-exfiltration-activity-to-an-unusual-destination-port, Potential Data Exfiltration Activity to an Unusual Destination Port>> |A machine learning job has detected data exfiltration to a particular destination port. Data transfer patterns that are outside the normal traffic patterns of an organization could indicate exfiltration over command and control channels. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |3
 
@@ -1184,21 +1186,23 @@ and their rule type is `machine_learning`.
 
 |<<potential-enumeration-via-active-directory-web-service, Potential Enumeration via Active Directory Web Service>> |Identifies processes loading Active Directory related modules followed by a network connection to the ADWS dedicated TCP port. Adversaries may abuse the ADWS Windows service that allows Active Directory to be queried via this web service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<potential-evasion-via-filter-manager, Potential Evasion via Filter Manager>> |The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<potential-evasion-via-filter-manager, Potential Evasion via Filter Manager>> |The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<potential-evasion-via-windows-filtering-platform, Potential Evasion via Windows Filtering Platform>> |Identifies multiple Windows Filtering Platform block events and where the process name is related to an endpoint security software. Adversaries may add malicious WFP rules to prevent Endpoint security from sending telemetry. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
+|<<potential-evasion-via-windows-filtering-platform, Potential Evasion via Windows Filtering Platform>> |Identifies multiple Windows Filtering Platform block events and where the process name is related to an endpoint security software. Adversaries may add malicious WFP rules to prevent Endpoint security from sending telemetry. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |3
+
+|<<potential-execution-via-xzbackdoor, Potential Execution via XZBackdoor>> |It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Persistence], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |1
 
 |<<potential-exploitation-of-an-unquoted-service-path-vulnerability, Potential Exploitation of an Unquoted Service Path Vulnerability>> |Adversaries may leverage unquoted service path vulnerabilities to escalate privileges. By placing an executable in a higher-level directory within the path of an unquoted service executable, Windows will natively launch this executable from its defined path variable instead of the benign one in a deeper directory, thus leading to code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<potential-external-linux-ssh-brute-force-detected, Potential External Linux SSH Brute Force Detected>> |Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |6
+|<<potential-external-linux-ssh-brute-force-detected, Potential External Linux SSH Brute Force Detected>> |Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |7
 
-|<<potential-file-transfer-via-certreq, Potential File Transfer via Certreq>> |Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |7
+|<<potential-file-transfer-via-certreq, Potential File Transfer via Certreq>> |Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to download files or upload data to a remote URL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Command and Control], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |8
 
 |<<potential-hidden-local-user-account-creation, Potential Hidden Local User Account Creation>> |Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<potential-hidden-process-via-mount-hidepid, Potential Hidden Process via Mount Hidepid>> |Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Auditd Manager] |8.3.0 |8
 
-|<<potential-internal-linux-ssh-brute-force-detected, Potential Internal Linux SSH Brute Force Detected>> |Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |10
+|<<potential-internal-linux-ssh-brute-force-detected, Potential Internal Linux SSH Brute Force Detected>> |Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |11
 
 |<<potential-invoke-mimikatz-powershell-script, Potential Invoke-Mimikatz PowerShell Script>> |Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell script and alike. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
@@ -1206,7 +1210,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-kerberos-attack-via-bifrost, Potential Kerberos Attack via Bifrost>> |Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> |Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |104
+|<<potential-lsa-authentication-package-abuse, Potential LSA Authentication Package Abuse>> |Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |105
 
 |<<potential-lsass-clone-creation-via-psscapturesnapshot, Potential LSASS Clone Creation via PssCaptureSnapShot>> |Identifies the creation of an LSASS process clone via PssCaptureSnapShot where the parent process is the initial LSASS process instance. This may indicate an attempt to evade detection and dump LSASS memory for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon] |8.3.0 |106
 
@@ -1230,13 +1234,13 @@ and their rule type is `machine_learning`.
 
 |<<potential-linux-tunneling-and-or-port-forwarding, Potential Linux Tunneling and/or Port Forwarding>> |This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |6
 
-|<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<potential-local-ntlm-relay-via-http, Potential Local NTLM Relay via HTTP>> |Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<potential-masquerading-as-browser-process, Potential Masquerading as Browser Process>> |Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |3
 
-|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution] |8.3.0 |3
+|<<potential-masquerading-as-business-app-installer, Potential Masquerading as Business App Installer>> |Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Tactic: Execution] |8.3.0 |4
 
-|<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |4
+|<<potential-masquerading-as-communication-apps, Potential Masquerading as Communication Apps>> |Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |5
 
 |<<potential-masquerading-as-system32-dll, Potential Masquerading as System32 DLL>> |Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs. |[Domain: Endpoint], [Data Source: Elastic Defend], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR] |8.4.0 |103
 
@@ -1250,7 +1254,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-microsoft-office-sandbox-evasion, Potential Microsoft Office Sandbox Evasion>> |Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<potential-modification-of-accessibility-binaries, Potential Modification of Accessibility Binaries>> |Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<potential-network-scan-detected, Potential Network Scan Detected>> |This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports. |[Domain: Network], [Tactic: Discovery], [Tactic: Reconnaissance], [Use Case: Network Security Monitoring] |8.3.0 |5
 
@@ -1272,7 +1276,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-pass-the-hash-pth-attempt, Potential Pass-the-Hash (PtH) Attempt>> |Adversaries may pass the hash using stolen password hashes to move laterally within an environment, bypassing normal system access controls. Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement] |8.4.0 |3
 
-|<<potential-password-spraying-of-microsoft-365-user-accounts, Potential Password Spraying of Microsoft 365 User Accounts>> |Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.3.0 |106
+|<<potential-password-spraying-of-microsoft-365-user-accounts, Potential Password Spraying of Microsoft 365 User Accounts>> |Identifies a high number (25) of failed Microsoft 365 user authentication attempts from a single IP address within 30 minutes, which could be indicative of a password spraying attack. An adversary may attempt a password spraying attack to obtain unauthorized access to user accounts. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Identity and Access Audit], [Tactic: Credential Access] |8.8.0 |207
 
 |<<potential-persistence-through-motd-file-creation-detected, Potential Persistence Through MOTD File Creation Detected>> |Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |9
 
@@ -1288,11 +1292,13 @@ and their rule type is `machine_learning`.
 
 |<<potential-persistence-via-periodic-tasks, Potential Persistence via Periodic Tasks>> |Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> |Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<potential-persistence-via-time-provider-modification, Potential Persistence via Time Provider Modification>> |Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+
+|<<potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> |Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<potential-port-monitor-or-print-processor-registration-abuse, Potential Port Monitor or Print Processor Registration Abuse>> |Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |105
+|<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs] |8.12.0 |111
 
-|<<potential-powershell-hacktool-script-by-function-names, Potential PowerShell HackTool Script by Function Names>> |Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: PowerShell Logs] |8.3.0 |10
+|<<potential-powershell-pass-the-hash-relay-script, Potential PowerShell Pass-the-Hash/Relay Script>> |Detects PowerShell scripts that can execute pass-the-hash (PtH) attacks, intercept and relay NTLM challenges, and carry out other man-in-the-middle (MitM) attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |1
 
 |<<potential-privacy-control-bypass-via-localhost-secure-copy, Potential Privacy Control Bypass via Localhost Secure Copy>> |Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -1306,7 +1312,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-privilege-escalation-via-enlightenment, Potential Privilege Escalation via Enlightenment>> |Identifies an attempt to exploit a local privilege escalation CVE-2022-37706 via a flaw in Linux window manager package Enlightenment. enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.11.0 |2
 
-|<<potential-privilege-escalation-via-installerfiletakeover, Potential Privilege Escalation via InstallerFileTakeOver>> |Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |110
+|<<potential-privilege-escalation-via-installerfiletakeover, Potential Privilege Escalation via InstallerFileTakeOver>> |Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<potential-privilege-escalation-via-linux-dac-permissions, Potential Privilege Escalation via Linux DAC permissions>> |Identifies potential privilege escalation exploitation of DAC (Discretionary access control) file permissions. The rule identifies exploitation of DAC checks on sensitive file paths via suspicious processes whose capabilities include CAP_DAC_OVERRIDE (where a process can bypass all read write and execution checks) or CAP_DAC_READ_SEARCH (where a process can read any file or perform any executable permission on the directories). |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.11.0 |2
 
@@ -1338,11 +1344,11 @@ and their rule type is `machine_learning`.
 
 |<<potential-remote-code-execution-via-web-server, Potential Remote Code Execution via Web Server>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |7
 
-|<<potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> |Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
+|<<potential-remote-credential-access-via-registry, Potential Remote Credential Access via Registry>> |Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<potential-remote-desktop-shadowing-activity, Potential Remote Desktop Shadowing Activity>> |Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<potential-remote-desktop-tunneling-detected, Potential Remote Desktop Tunneling Detected>> |Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<potential-remote-file-execution-via-msiexec, Potential Remote File Execution via MSIEXEC>> |Identifies the execution of the built-in Windows Installer, msiexec.exe, to install a remote package. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
 
@@ -1366,7 +1372,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-syn-based-network-scan-detected, Potential SYN-Based Network Scan Detected>> |This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port. |[Domain: Network], [Tactic: Discovery], [Tactic: Reconnaissance], [Use Case: Network Security Monitoring] |8.3.0 |5
 
-|<<potential-secure-file-deletion-via-sdelete-utility, Potential Secure File Deletion via SDelete Utility>> |Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Impact], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<potential-secure-file-deletion-via-sdelete-utility, Potential Secure File Deletion via SDelete Utility>> |Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Impact], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<potential-shadow-credentials-added-to-ad-object, Potential Shadow Credentials added to AD Object>> |Identify the modification of the msDS-KeyCredentialLink attribute in an Active Directory Computer or User Object. Attackers can abuse control over the object and create a key pair, append to raw public key in the attribute, and obtain persistent and stealthy access to the target user or computer object. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |108
 
@@ -1380,7 +1386,7 @@ and their rule type is `machine_learning`.
 
 |<<potential-successful-linux-rdp-brute-force-attack-detected, Potential Successful Linux RDP Brute Force Attack Detected>> |An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |7
 
-|<<potential-successful-ssh-brute-force-attack, Potential Successful SSH Brute Force Attack>> |Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |10
+|<<potential-successful-ssh-brute-force-attack, Potential Successful SSH Brute Force Attack>> |Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Credential Access] |8.3.0 |11
 
 |<<potential-sudo-hijacking-detected, Potential Sudo Hijacking Detected>> |Identifies the creation of a sudo binary located at /usr/bin/sudo. Attackers may hijack the default sudo binary and replace it with a custom binary or script that can read the user's password in clear text to escalate privileges or enable persistence onto the system every time the sudo binary is executed. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |105
 
@@ -1422,21 +1428,21 @@ and their rule type is `machine_learning`.
 
 |<<powershell-minidump-script, PowerShell MiniDump Script>> |This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
-|<<powershell-psreflect-script, PowerShell PSReflect Script>> |Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |110
+|<<powershell-psreflect-script, PowerShell PSReflect Script>> |Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.12.0 |210
 
-|<<powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> |Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<powershell-script-block-logging-disabled, PowerShell Script Block Logging Disabled>> |Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<powershell-script-with-archive-compression-capabilities, PowerShell Script with Archive Compression Capabilities>> |Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |5
+|<<powershell-script-with-archive-compression-capabilities, PowerShell Script with Archive Compression Capabilities>> |Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.12.0 |105
 
-|<<powershell-script-with-discovery-capabilities, PowerShell Script with Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Discovery], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |6
+|<<powershell-script-with-discovery-capabilities, PowerShell Script with Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Tactic: Discovery], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.12.0 |106
 
 |<<powershell-script-with-encryption-decryption-capabilities, PowerShell Script with Encryption/Decryption Capabilities>> |Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |6
 
-|<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |5
+|<<powershell-script-with-log-clear-capabilities, PowerShell Script with Log Clear Capabilities>> |Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.12.0 |105
 
 |<<powershell-script-with-password-policy-discovery-capabilities, PowerShell Script with Password Policy Discovery Capabilities>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |5
 
-|<<powershell-script-with-remote-execution-capabilities-via-winrm, PowerShell Script with Remote Execution Capabilities via WinRM>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.3.0 |6
+|<<powershell-script-with-remote-execution-capabilities-via-winrm, PowerShell Script with Remote Execution Capabilities via WinRM>> |Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Execution], [Data Source: PowerShell Logs], [Rule Type: BBR] |8.12.0 |106
 
 |<<powershell-script-with-token-impersonation-capabilities, PowerShell Script with Token Impersonation Capabilities>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: PowerShell Logs] |8.3.0 |11
 
@@ -1446,13 +1452,13 @@ and their rule type is `machine_learning`.
 
 |<<powershell-share-enumeration-script, PowerShell Share Enumeration Script>> |Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |9
 
-|<<powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> |This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |113
+|<<powershell-suspicious-discovery-related-windows-api-functions, PowerShell Suspicious Discovery Related Windows API Functions>> |This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.12.0 |213
 
-|<<powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> |Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |111
+|<<powershell-suspicious-payload-encoded-and-compressed, PowerShell Suspicious Payload Encoded and Compressed>> |Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.12.0 |211
 
 |<<powershell-suspicious-script-with-audio-capture-capabilities, PowerShell Suspicious Script with Audio Capture Capabilities>> |Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |110
 
-|<<powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> |Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.3.0 |8
+|<<powershell-suspicious-script-with-clipboard-retrieval-capabilities, PowerShell Suspicious Script with Clipboard Retrieval Capabilities>> |Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: PowerShell Logs], [Resources: Investigation Guide] |8.12.0 |108
 
 |<<powershell-suspicious-script-with-screenshot-capabilities, PowerShell Suspicious Script with Screenshot Capabilities>> |Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |108
 
@@ -1462,25 +1468,25 @@ and their rule type is `machine_learning`.
 
 |<<privilege-escalation-via-gdb-cap-sys-ptrace, Privilege Escalation via GDB CAP_SYS_PTRACE>> |Identifies instances where GDB (granted the CAP_SYS_PTRACE capability) is executed, after which the user's access is elevated to UID/GID 0 (root). In Linux, the CAP_SYS_PTRACE capability grants a process the ability to use the ptrace system call, which is typically used for debugging and allows the process to trace and control other processes. Attackers may leverage this capability to hook and inject into a process that is running with root permissions in order to escalate their privileges to root. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.11.0 |2
 
-|<<privilege-escalation-via-named-pipe-impersonation, Privilege Escalation via Named Pipe Impersonation>> |Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<privilege-escalation-via-named-pipe-impersonation, Privilege Escalation via Named Pipe Impersonation>> |Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<privilege-escalation-via-rogue-named-pipe-impersonation, Privilege Escalation via Rogue Named Pipe Impersonation>> |Identifies a privilege escalation attempt via rogue named pipe impersonation. An adversary may abuse this technique by masquerading as a known named pipe and manipulating a privileged process to connect to it. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Sysmon] |8.3.0 |106
 
 |<<privilege-escalation-via-root-crontab-file-modification, Privilege Escalation via Root Crontab File Modification>> |Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |105
+|<<privilege-escalation-via-windir-environment-variable, Privilege Escalation via Windir Environment Variable>> |Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
 
 |<<privileged-account-brute-force, Privileged Account Brute Force>> |Identifies multiple consecutive logon failures targeting an Admin account from the same source address and within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to accounts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide] |8.3.0 |9
 
-|<<privileges-elevation-via-parent-process-pid-spoofing, Privileges Elevation via Parent Process PID Spoofing>> |Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |6
+|<<privileges-elevation-via-parent-process-pid-spoofing, Privileges Elevation via Parent Process PID Spoofing>> |Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |7
 
-|<<process-activity-via-compiled-html-file, Process Activity via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<process-activity-via-compiled-html-file, Process Activity via Compiled HTML File>> |Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe). |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<process-capability-enumeration, Process Capability Enumeration>> |Identifies recursive process capability enumeration of the entire filesystem through the getcap command. Malicious users may manipulate identified capabilities to gain root privileges. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.11.0 |2
 
-|<<process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> |Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |2
+|<<process-created-with-a-duplicated-token, Process Created with a Duplicated Token>> |Identifies the creation of a process impersonating the token of another user logon session. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |3
 
-|<<process-created-with-an-elevated-token, Process Created with an Elevated Token>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |5
+|<<process-created-with-an-elevated-token, Process Created with an Elevated Token>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.4.0 |6
 
 |<<process-creation-via-secondary-logon, Process Creation via Secondary Logon>> |Identifies process creation with alternate credentials. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |9
 
@@ -1488,7 +1494,7 @@ and their rule type is `machine_learning`.
 
 |<<process-discovery-via-built-in-applications, Process Discovery via Built-In Applications>> |Identifies the use of built-in tools attackers can use to discover running processes on an endpoint. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |3
 
-|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<process-execution-from-an-unusual-directory, Process Execution from an Unusual Directory>> |Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<process-injection-detected-elastic-endgame, Process Injection - Detected - Elastic Endgame>> |Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information. |[Data Source: Elastic Endgame], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |102
 
@@ -1502,7 +1508,7 @@ and their rule type is `machine_learning`.
 
 |<<processes-with-trailing-spaces, Processes with Trailing Spaces>> |Identify instances where adversaries include trailing space characters to mimic regular files, disguising their activity to evade default file handling mechanisms. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |2
 
-|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<program-files-directory-masquerading, Program Files Directory Masquerading>> |Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<prompt-for-credentials-with-osascript, Prompt for Credentials with OSASCRIPT>> |Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -1512,11 +1518,11 @@ and their rule type is `machine_learning`.
 
 |<<python-script-execution-via-command-line, Python Script Execution via Command Line>> |Identifies when a Python script is executed using command line input and imports the sys module. Attackers often use this method to execute malicious scripts and avoiding writing it to disk. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<query-registry-using-built-in-tools, Query Registry using Built-in Tools>> |This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |103
+|<<query-registry-using-built-in-tools, Query Registry using Built-in Tools>> |This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.6.0 |104
 
 |<<rdp-remote-desktop-protocol-from-the-internet, RDP (Remote Desktop Protocol) from the Internet>> |This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection] |8.3.0 |103
 
-|<<rdp-enabled-via-registry, RDP Enabled via Registry>> |Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<rdp-enabled-via-registry, RDP Enabled via Registry>> |Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<rpc-remote-procedure-call-from-the-internet, RPC (Remote Procedure Call) from the Internet>> |This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Initial Access], [Domain: Endpoint], [Use Case: Threat Detection] |8.3.0 |103
 
@@ -1528,27 +1534,27 @@ and their rule type is `machine_learning`.
 
 |<<rare-aws-error-code, Rare AWS Error Code>> |A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.9.0 |208
 
-|<<rare-smb-connection-to-the-internet, Rare SMB Connection to the Internet>> |This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |2
+|<<rare-smb-connection-to-the-internet, Rare SMB Connection to the Internet>> |This rule detects rare internet network connections via the SMB protocol. SMB is commonly used to leak NTLM credentials via rogue UNC path injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Exfiltration], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |3
 
 |<<rare-user-logon, Rare User Logon>> |A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access], [Resources: Investigation Guide] |8.3.0 |104
 
-|<<registry-persistence-via-appcert-dll, Registry Persistence via AppCert DLL>> |Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<registry-persistence-via-appcert-dll, Registry Persistence via AppCert DLL>> |Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<registry-persistence-via-appinit-dll, Registry Persistence via AppInit DLL>> |AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<registry-persistence-via-appinit-dll, Registry Persistence via AppInit DLL>> |AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
 |<<remote-computer-account-dnshostname-update, Remote Computer Account DnsHostName Update>> |Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Active Directory Monitoring], [Data Source: Active Directory], [Use Case: Vulnerability] |8.3.0 |107
 
-|<<remote-desktop-enabled-in-windows-firewall-by-netsh, Remote Desktop Enabled in Windows Firewall by Netsh>> |Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<remote-desktop-enabled-in-windows-firewall-by-netsh, Remote Desktop Enabled in Windows Firewall by Netsh>> |Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<remote-execution-via-file-shares, Remote Execution via File Shares>> |Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<remote-file-copy-to-a-hidden-share, Remote File Copy to a Hidden Share>> |Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<remote-file-copy-via-teamviewer, Remote File Copy via TeamViewer>> |Identifies an executable or script file remotely downloaded via a TeamViewer transfer session. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<remote-file-download-via-desktopimgdownldr-utility, Remote File Download via Desktopimgdownldr Utility>> |Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<remote-file-download-via-desktopimgdownldr-utility, Remote File Download via Desktopimgdownldr Utility>> |Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
-|<<remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> |Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<remote-file-download-via-mpcmdrun, Remote File Download via MpCmdRun>> |Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<remote-file-download-via-powershell, Remote File Download via PowerShell>> |Identifies powershell.exe being used to download an executable file from an untrusted remote destination. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
 
@@ -1566,17 +1572,17 @@ and their rule type is `machine_learning`.
 
 |<<remote-xsl-script-execution-via-com, Remote XSL Script Execution via COM>> |Identifies the execution of a hosted XSL script using the Microsoft.XMLDOM COM interface via Microsoft Office processes. This behavior may indicate adversarial activity to execute malicious JScript or VBScript on the system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators." |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<remotely-started-services-via-rpc, Remotely Started Services via RPC>> |Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
-|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<renamed-autoit-scripts-interpreter, Renamed AutoIt Scripts Interpreter>> |Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> |Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<renamed-utility-executed-with-short-program-name, Renamed Utility Executed with Short Program Name>> |Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<root-network-connection-via-gdb-cap-sys-ptrace, Root Network Connection via GDB CAP_SYS_PTRACE>> |Identifies instances where GDB (granted the CAP_SYS_PTRACE capability) is executed, after which an outbound network connection is initiated by UID/GID 0 (root). In Linux, the CAP_SYS_PTRACE capability grants a process the ability to use the ptrace system call, which is typically used for debugging and allows the process to trace and control other processes. Attackers may leverage this capability to hook and inject into a process that is running with root permissions in order to execute shell code and gain a reverse shell with root privileges. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Execution], [Tactic: Command and Control], [Data Source: Elastic Defend] |8.11.0 |2
 
 |<<roshal-archive-rar-or-powershell-file-downloaded-from-the-internet, Roshal Archive (RAR) or PowerShell File Downloaded from the Internet>> |Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control. |[Use Case: Threat Detection], [Tactic: Command and Control], [Domain: Endpoint] |8.3.0 |103
 
-|<<sip-provider-modification, SIP Provider Modification>> |Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<sip-provider-modification, SIP Provider Modification>> |Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<smb-windows-file-sharing-activity-to-the-internet, SMB (Windows File Sharing) Activity to the Internet>> |This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration. |[Tactic: Initial Access], [Domain: Endpoint], [Use Case: Threat Detection] |8.3.0 |103
 
@@ -1592,19 +1598,21 @@ and their rule type is `machine_learning`.
 
 |<<suid-sguid-enumeration-detected, SUID/SGUID Enumeration Detected>> |This rule monitors for the usage of the "find" command in conjunction with SUID and SGUID permission arguments. SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow a program to execute with the privileges of the file owner or group, respectively, rather than the privileges of the user running the program. In case an attacker is able to enumerate and find a binary that is misconfigured, they might be able to leverage this misconfiguration to escalate privileges by exploiting vulnerabilities or built-in features in the privileged program. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |5
 
-|<<sunburst-command-and-control-activity, SUNBURST Command and Control Activity>> |The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |107
+|<<sunburst-command-and-control-activity, SUNBURST Command and Control Activity>> |The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
 |<<scheduled-task-created-by-a-windows-script, Scheduled Task Created by a Windows Script>> |A scheduled task was created by a Windows script via cscript.exe, wscript.exe or powershell.exe. This can be abused by an adversary to establish persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
 
 |<<scheduled-task-execution-at-scale-via-gpo, Scheduled Task Execution at Scale via GPO>> |Detects the modification of Group Policy Object attributes to execute a scheduled task in the objects controlled by the GPO. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Lateral Movement], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |110
 
-|<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<scheduled-tasks-at-command-enabled, Scheduled Tasks AT Command Enabled>> |Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+
+|<<screenconnect-server-spawning-suspicious-processes, ScreenConnect Server Spawning Suspicious Processes>> |Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |1
 
 |<<screensaver-plist-file-modified-by-unexpected-process, Screensaver Plist File Modified by Unexpected Process>> |Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |107
 
 |<<sedebugprivilege-enabled-by-a-suspicious-process, SeDebugPrivilege Enabled by a Suspicious Process>> |Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |7
 
-|<<searching-for-saved-credentials-via-vaultcmd, Searching for Saved Credentials via VaultCmd>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<searching-for-saved-credentials-via-vaultcmd, Searching for Saved Credentials via VaultCmd>> |Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<security-software-discovery-using-wmic, Security Software Discovery using WMIC>> |Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |110
 
@@ -1622,7 +1630,7 @@ and their rule type is `machine_learning`.
 
 |<<service-command-lateral-movement, Service Command Lateral Movement>> |Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
 
-|<<service-control-spawned-via-script-interpreter, Service Control Spawned via Script Interpreter>> |Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |107
+|<<service-control-spawned-via-script-interpreter, Service Control Spawned via Script Interpreter>> |Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
 |<<service-creation-via-local-kerberos-authentication, Service Creation via Local Kerberos Authentication>> |Identifies a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, followed by a sevice creation from the same LogonId. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined user to local System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |105
 
@@ -1636,7 +1644,7 @@ and their rule type is `machine_learning`.
 
 |<<setuid-setgid-bit-set-via-chmod, Setuid / Setgid Bit Set via chmod>> |An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user’s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |103
 
-|<<sharepoint-malware-file-upload, SharePoint Malware File Upload>> |Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.3.0 |105
+|<<sharepoint-malware-file-upload, SharePoint Malware File Upload>> |Identifies the occurence of files uploaded to SharePoint being detected as Malware by the file scanning engine. Attackers can use File Sharing and Organization Repositories to spread laterally within the company and amplify their access. Users can inadvertently share these files without knowing their maliciousness, giving adversaries opportunities to gain initial access to other endpoints in the environment. |[Domain: Cloud], [Data Source: Microsoft 365], [Tactic: Lateral Movement] |8.8.0 |206
 
 |<<shared-object-created-or-changed-by-previously-unknown-process, Shared Object Created or Changed by Previously Unknown Process>> |This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |7
 
@@ -1648,7 +1656,7 @@ and their rule type is `machine_learning`.
 
 |<<softwareupdate-preferences-modification, SoftwareUpdate Preferences Modification>> |Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> |Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<solarwinds-process-disabling-services-via-registry, SolarWinds Process Disabling Services via Registry>> |Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<spike-in-aws-error-messages, Spike in AWS Error Messages>> |A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.9.0 |208
 
@@ -1678,9 +1686,9 @@ and their rule type is `machine_learning`.
 
 |<<startup-folder-persistence-via-unsigned-process, Startup Folder Persistence via Unsigned Process>> |Identifies files written or modified in the startup folder by unsigned processes. Adversaries may abuse this technique to maintain persistence in an environment. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<startup-persistence-by-a-suspicious-process, Startup Persistence by a Suspicious Process>> |Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<startup-persistence-by-a-suspicious-process, Startup Persistence by a Suspicious Process>> |Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<startup-or-run-key-registry-modification, Startup or Run Key Registry Modification>> |Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<startup-or-run-key-registry-modification, Startup or Run Key Registry Modification>> |Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<startup-logon-script-added-to-group-policy-object, Startup/Logon Script added to Group Policy Object>> |Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Active Directory], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring] |8.3.0 |109
 
@@ -1698,9 +1706,9 @@ and their rule type is `machine_learning`.
 
 |<<sudoers-file-modification, Sudoers File Modification>> |A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.6.0 |204
 
-|<<suspicious-net-code-compilation, Suspicious .NET Code Compilation>> |Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt to compile code after delivery in order to bypass security mechanisms. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<suspicious-net-code-compilation, Suspicious .NET Code Compilation>> |Identifies executions of .NET compilers with suspicious parent processes, which can indicate an attacker's attempt to compile code after delivery in order to bypass security mechanisms. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<suspicious-net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> |Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |112
+|<<suspicious-net-reflection-via-powershell, Suspicious .NET Reflection via PowerShell>> |Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.12.0 |212
 
 |<<suspicious-proc-maps-discovery, Suspicious /proc/maps Discovery>> |Monitors for /proc/*/maps file reads. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend] |8.3.0 |2
 
@@ -1708,9 +1716,11 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-apt-package-manager-network-connection, Suspicious APT Package Manager Network Connection>> |Detects suspicious network events executed by the APT package manager, potentially indicating persistence through an APT backdoor. In Linux, APT (Advanced Package Tool) is a command-line utility used for handling packages on Debian-based systems, providing functions for installing, updating, upgrading, and removing software along with managing package repositories. Attackers can backdoor APT to gain persistence by injecting malicious code into scripts that APT runs, thereby ensuring continued unauthorized access or control each time APT is used for package management. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Command and Control], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |2
 
+|<<suspicious-access-to-ldap-attributes, Suspicious Access to LDAP Attributes>> |Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: System], [Data Source: Active Directory], [Data Source: Windows] |8.3.0 |1
+
 |<<suspicious-activity-reported-by-okta-user, Suspicious Activity Reported by Okta User>> |Detects when a user reports suspicious activity for their Okta account. These events should be investigated, as they can help security teams identify when an adversary is attempting to gain access to their network. |[Use Case: Identity and Access Audit], [Data Source: Okta], [Tactic: Initial Access] |8.10.0 |205
 
-|<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |8
+|<<suspicious-antimalware-scan-interface-dll, Suspicious Antimalware Scan Interface DLL>> |Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |9
 
 |<<suspicious-automator-workflows-execution, Suspicious Automator Workflows Execution>> |Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -1718,11 +1728,11 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-calendar-file-modification, Suspicious Calendar File Modification>> |Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-certutil-commands, Suspicious CertUtil Commands>> |Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |107
+|<<suspicious-certutil-commands, Suspicious CertUtil Commands>> |Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
 |<<suspicious-child-process-of-adobe-acrobat-reader-update-service, Suspicious Child Process of Adobe Acrobat Reader Update Service>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<suspicious-cmd-execution-via-wmi, Suspicious Cmd Execution via WMI>> |Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<suspicious-communication-app-child-process, Suspicious Communication App Child Process>> |Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |3
 
@@ -1730,7 +1740,7 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-crontab-creation-or-modification, Suspicious CronTab Creation or Modification>> |Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<suspicious-dll-loaded-for-persistence-or-privilege-escalation, Suspicious DLL Loaded for Persistence or Privilege Escalation>> |Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<suspicious-data-encryption-via-openssl-utility, Suspicious Data Encryption via OpenSSL Utility>> |Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |6
 
@@ -1738,21 +1748,21 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-emond-child-process, Suspicious Emond Child Process>> |Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<suspicious-endpoint-security-parent-process, Suspicious Endpoint Security Parent Process>> |A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> |Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |1
+|<<suspicious-execution-from-inet-cache, Suspicious Execution from INET Cache>> |Identifies the execution of a process with arguments pointing to the INetCache Folder. Adversaries may deliver malicious content via WININET during initial access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |2
 
-|<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<suspicious-execution-from-a-mounted-device, Suspicious Execution from a Mounted Device>> |Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<suspicious-execution-via-msiexec, Suspicious Execution via MSIEXEC>> |Identifies suspicious execution of the built-in Windows Installer, msiexec.exe, to install a package from usual paths or parent process. Adversaries may abuse msiexec.exe to launch malicious local MSI files. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<suspicious-execution-via-microsoft-office-add-ins, Suspicious Execution via Microsoft Office Add-Ins>> |Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |4
+|<<suspicious-execution-via-microsoft-office-add-ins, Suspicious Execution via Microsoft Office Add-Ins>> |Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |5
 
-|<<suspicious-execution-via-scheduled-task, Suspicious Execution via Scheduled Task>> |Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |107
+|<<suspicious-execution-via-scheduled-task, Suspicious Execution via Scheduled Task>> |Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<suspicious-execution-via-windows-subsystem-for-linux, Suspicious Execution via Windows Subsystem for Linux>> |Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
+|<<suspicious-execution-via-windows-subsystem-for-linux, Suspicious Execution via Windows Subsystem for Linux>> |Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
 
-|<<suspicious-explorer-child-process, Suspicious Explorer Child Process>> |Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<suspicious-explorer-child-process, Suspicious Explorer Child Process>> |Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<suspicious-file-changes-activity-detected, Suspicious File Changes Activity Detected>> |This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Impact], [Data Source: Elastic Defend] |8.3.0 |8
 
@@ -1766,39 +1776,41 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-hidden-child-process-of-launchd, Suspicious Hidden Child Process of Launchd>> |Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |106
 
-|<<suspicious-image-load-taskschd-dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> |Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<suspicious-image-load-taskschd-dll-from-ms-office, Suspicious Image Load (taskschd.dll) from MS Office>> |Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<suspicious-imagepath-service-creation, Suspicious ImagePath Service Creation>> |Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<suspicious-imagepath-service-creation, Suspicious ImagePath Service Creation>> |Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<suspicious-inter-process-communication-via-outlook, Suspicious Inter-Process Communication via Outlook>> |Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Defend] |8.4.0 |5
+|<<suspicious-inter-process-communication-via-outlook, Suspicious Inter-Process Communication via Outlook>> |Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Collection], [Data Source: Elastic Defend] |8.4.0 |6
 
 |<<suspicious-interactive-shell-spawned-from-inside-a-container, Suspicious Interactive Shell Spawned From Inside A Container>> |This rule detects when an interactive shell is spawned inside a running container. This could indicate a potential container breakout attempt or an attacker's attempt to gain unauthorized access to the underlying host. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution] |8.8.0 |2
 
 |<<suspicious-java-child-process, Suspicious JAVA Child Process>> |Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.6.0 |208
 
+|<<suspicious-jetbrains-teamcity-child-process, Suspicious JetBrains TeamCity Child Process>> |Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |1
+
 |<<suspicious-kworker-uid-elevation, Suspicious Kworker UID Elevation>> |Monitors for the elevation of regular user permissions to root permissions through the kworker process. kworker, or kernel worker, processes are part of the kernel's workqueue mechanism. They are responsible for executing work that has been scheduled to be done in kernel space, which might include tasks like handling interrupts, background activities, and other kernel-related tasks. Attackers may attempt to evade detection by masquerading as a kernel worker process, and hijack the execution flow by hooking certain functions/syscalls through a rootkit in order to provide easy access to root via a special modified command. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |2
 
 |<<suspicious-lsass-access-via-malseclogon, Suspicious LSASS Access via MalSecLogon>> |Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon] |8.8.0 |208
 
 |<<suspicious-lsass-process-access, Suspicious Lsass Process Access>> |Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Sysmon] |8.8.0 |107
 
-|<<suspicious-ms-office-child-process, Suspicious MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<suspicious-ms-office-child-process, Suspicious MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
-|<<suspicious-ms-outlook-child-process, Suspicious MS Outlook Child Process>> |Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<suspicious-ms-outlook-child-process, Suspicious MS Outlook Child Process>> |Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<suspicious-managed-code-hosting-process, Suspicious Managed Code Hosting Process>> |Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<suspicious-memory-grep-activity, Suspicious Memory grep Activity>> |Monitors for grep activity related to memory mapping. The /proc/*/maps file in Linux provides a memory map for a specific process, detailing the memory segments, permissions, and what files are mapped to these segments. Attackers may read a process's memory map to identify memory addresses for code injection or process hijacking. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |2
 
-|<<suspicious-microsoft-365-mail-access-by-clientappid, Suspicious Microsoft 365 Mail Access by ClientAppId>> |Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.6.0 |4
+|<<suspicious-microsoft-365-mail-access-by-clientappid, Suspicious Microsoft 365 Mail Access by ClientAppId>> |Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days. |[Domain: Cloud], [Data Source: Microsoft 365], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.8.0 |105
 
-|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<suspicious-microsoft-diagnostics-wizard-execution, Suspicious Microsoft Diagnostics Wizard Execution>> |Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<suspicious-mining-process-creation-event, Suspicious Mining Process Creation Event>> |Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
 
 |<<suspicious-modprobe-file-event, Suspicious Modprobe File Event>> |Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.6.0 |107
 
-|<<suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> |Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |7
+|<<suspicious-module-loaded-by-lsass, Suspicious Module Loaded by LSASS>> |Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |8
 
 |<<suspicious-network-activity-to-the-internet-by-previously-unknown-executable, Suspicious Network Activity to the Internet by Previously Unknown Executable>> |This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory to a previously unknown destination ip. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Command and Control], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.6.0 |8
 
@@ -1808,23 +1820,23 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-network-tool-launched-inside-a-container, Suspicious Network Tool Launched Inside A Container>> |This rule detects commonly abused network utilities running inside a container. Network utilities like nc, nmap, dig, tcpdump, ngrep, telnet, mitmproxy, zmap can be used for malicious purposes such as network reconnaissance, monitoring, or exploitation, and should be monitored closely within a container. |[Data Source: Elastic Defend for Containers], [Domain: Container], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Command and Control], [Tactic: Reconnaissance] |8.8.0 |2
 
-|<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<suspicious-pdf-reader-child-process, Suspicious PDF Reader Child Process>> |Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Initial Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<suspicious-passwd-file-event-action, Suspicious Passwd File Event Action>> |Monitors for the generation of a passwd password entry via openssl, followed by a file write activity on the "/etc/passwd" file. The "/etc/passwd" file in Linux stores user account information, including usernames, user IDs, group IDs, home directories, and default shell paths. Attackers may exploit a misconfiguration in the "/etc/passwd" file permissions or other privileges to add a new entry to the "/etc/passwd" file with root permissions, and leverage this new user account to login as root. |[Data Source: Auditd Manager], [Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Defend] |8.3.0 |3
 
 |<<suspicious-portable-executable-encoded-in-powershell-script, Suspicious Portable Executable Encoded in Powershell Script>> |Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: PowerShell Logs] |8.3.0 |110
 
-|<<suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> |Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |209
+|<<suspicious-powershell-engine-imageload, Suspicious PowerShell Engine ImageLoad>> |Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |210
 
 |<<suspicious-powershell-script, Suspicious Powershell Script>> |A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Execution] |8.3.0 |104
 
-|<<suspicious-print-spooler-file-deletion, Suspicious Print Spooler File Deletion>> |Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<suspicious-print-spooler-file-deletion, Suspicious Print Spooler File Deletion>> |Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<suspicious-print-spooler-point-and-print-dll, Suspicious Print Spooler Point and Print DLL>> |Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |105
+|<<suspicious-print-spooler-point-and-print-dll, Suspicious Print Spooler Point and Print DLL>> |Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
 
-|<<suspicious-print-spooler-spl-file-created, Suspicious Print Spooler SPL File Created>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |110
+|<<suspicious-print-spooler-spl-file-created, Suspicious Print Spooler SPL File Created>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<suspicious-printspooler-service-executable-file-creation, Suspicious PrintSpooler Service Executable File Creation>> |Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<suspicious-proc-pseudo-file-system-enumeration, Suspicious Proc Pseudo File System Enumeration>> |This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets. |[Data Source: Auditd Manager], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR] |8.3.0 |7
 
@@ -1832,11 +1844,11 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-process-creation-calltrace, Suspicious Process Creation CallTrace>> |Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Sysmon] |8.8.0 |208
 
-|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<suspicious-process-execution-via-renamed-psexec-executable, Suspicious Process Execution via Renamed PsExec Executable>> |Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<suspicious-process-spawned-from-motd-detected, Suspicious Process Spawned from MOTD Detected>> |Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the "/etc/update-motd.d/" and "/usr/lib/update-notifier/" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |8
 
-|<<suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> |Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<suspicious-rdp-activex-client-loaded, Suspicious RDP ActiveX Client Loaded>> |Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<suspicious-remote-registry-access-via-sebackupprivilege, Suspicious Remote Registry Access via SeBackupPrivilege>> |Identifies remote access to the registry using an account with Backup Operators group membership. This may indicate an attempt to exfiltrate credentials by dumping the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Use Case: Active Directory Monitoring], [Data Source: Active Directory] |8.3.0 |110
 
@@ -1844,13 +1856,15 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-renaming-of-esxi-index-html-file, Suspicious Renaming of ESXI index.html File>> |Identifies instances where the "index.html" file within the "/usr/lib/vmware/*" directory is renamed on a Linux system. The rule monitors for the "rename" event action associated with this specific file and path, which could indicate malicious activity. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.5.0 |6
 
+|<<suspicious-screenconnect-client-child-process, Suspicious ScreenConnect Client Child Process>> |Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Command and Control], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |1
+
 |<<suspicious-script-object-execution, Suspicious Script Object Execution>> |Identifies scrobj.dll loaded into unusual Microsoft processes. This usually means a malicious scriptlet is being executed in the target process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<suspicious-service-was-installed-in-the-system, Suspicious Service was Installed in the System>> |Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide] |8.3.0 |8
 
-|<<suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> |A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<suspicious-solarwinds-child-process, Suspicious SolarWinds Child Process>> |A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<suspicious-startup-shell-folder-modification, Suspicious Startup Shell Folder Modification>> |Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
 |<<suspicious-symbolic-link-created, Suspicious Symbolic Link Created>> |Identifies the creation of a symbolic link to a suspicious file or location. A symbolic link is a reference to a file or directory that acts as a pointer or shortcut, allowing users to access the target file or directory from a different location in the file system. An attacker can potentially leverage symbolic links for privilege escalation by tricking a privileged process into following the symbolic link to a sensitive file, giving the attacker access to data or capabilities they would not normally have. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Credential Access], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |5
 
@@ -1866,27 +1880,27 @@ and their rule type is `machine_learning`.
 
 |<<suspicious-wmi-event-subscription-created, Suspicious WMI Event Subscription Created>> |Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Sysmon] |8.8.0 |106
 
-|<<suspicious-wmi-image-load-from-ms-office, Suspicious WMI Image Load from MS Office>> |Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<suspicious-wmi-image-load-from-ms-office, Suspicious WMI Image Load from MS Office>> |Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<suspicious-wmic-xsl-script-execution, Suspicious WMIC XSL Script Execution>> |Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<suspicious-werfault-child-process, Suspicious WerFault Child Process>> |A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<suspicious-werfault-child-process, Suspicious WerFault Child Process>> |A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Persistence], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
-|<<suspicious-windows-process-cluster-spawned-by-a-host, Suspicious Windows Process Cluster Spawned by a Host>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<suspicious-windows-process-cluster-spawned-by-a-host, Suspicious Windows Process Cluster Spawned by a Host>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same host name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<suspicious-windows-process-cluster-spawned-by-a-parent-process, Suspicious Windows Process Cluster Spawned by a Parent Process>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<suspicious-windows-process-cluster-spawned-by-a-parent-process, Suspicious Windows Process Cluster Spawned by a Parent Process>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same parent process name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<suspicious-windows-process-cluster-spawned-by-a-user, Suspicious Windows Process Cluster Spawned by a User>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<suspicious-windows-process-cluster-spawned-by-a-user, Suspicious Windows Process Cluster Spawned by a User>> |A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<suspicious-zoom-child-process, Suspicious Zoom Child Process>> |A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |109
+|<<suspicious-zoom-child-process, Suspicious Zoom Child Process>> |A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<suspicious-macos-ms-office-child-process, Suspicious macOS MS Office Child Process>> |Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Initial Access], [Data Source: Elastic Defend] |8.3.0 |106
 
 |<<suspicious-which-enumeration, Suspicious which Enumeration>> |This rule monitors for the usage of the which command with an unusual amount of process arguments. Attackers may leverage the which command to enumerate the system for useful installed utilities that may be used after compromising a system to escalate privileges or move latteraly across the network. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |5
 
-|<<svchost-spawning-cmd, Svchost spawning Cmd>> |Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |210
+|<<svchost-spawning-cmd, Svchost spawning Cmd>> |Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.6.0 |211
 
-|<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<symbolic-link-to-shadow-copy-created, Symbolic Link to Shadow Copy Created>> |Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<system-binary-copied-and-or-moved-to-suspicious-directory, System Binary Copied and/or Moved to Suspicious Directory>> |This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.3.0 |7
 
@@ -1902,7 +1916,7 @@ and their rule type is `machine_learning`.
 
 |<<system-service-discovery-through-built-in-windows-utilities, System Service Discovery through built-in Windows Utilities>> |Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |5
 
-|<<system-shells-via-services, System Shells via Services>> |Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<system-shells-via-services, System Shells via Services>> |Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<system-time-discovery, System Time Discovery>> |Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Rule Type: BBR] |8.3.0 |6
 
@@ -1918,7 +1932,7 @@ and their rule type is `machine_learning`.
 
 |<<temporarily-scheduled-task-creation, Temporarily Scheduled Task Creation>> |Indicates the creation and deletion of a scheduled task within a short time interval. Adversaries can use these to proxy malicious execution via the schedule service and perform clean up. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Execution] |8.3.0 |7
 
-|<<third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> |Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<third-party-backup-files-deleted-via-unexpected-process, Third-party Backup Files Deleted via Unexpected Process>> |Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
 |<<threat-intel-hash-indicator-match, Threat Intel Hash Indicator Match>> |This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events. |[OS: Windows], [Data Source: Elastic Endgame], [Rule Type: Indicator Match] |8.5.0 |7
 
@@ -1932,25 +1946,25 @@ and their rule type is `machine_learning`.
 
 |<<trap-signals-execution, Trap Signals Execution>> |Identify activity related where adversaries can include a trap command which then allows programs and shells to specify commands that will be executed upon receiving interrupt signals. |[Domain: Endpoint], [OS: Linux], [OS: macOS], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame], [Data Source: Auditd Manager] |8.3.0 |2
 
-|<<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer, UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer>> |Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer, UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer>> |Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> |Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<uac-bypass-attempt-via-privileged-ifileoperation-com-interface, UAC Bypass Attempt via Privileged IFileOperation COM Interface>> |Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
+|<<uac-bypass-attempt-via-windows-directory-masquerading, UAC Bypass Attempt via Windows Directory Masquerading>> |Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |112
 
-|<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> |Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface, UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface>> |Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<uac-bypass-via-diskcleanup-scheduled-task-hijack, UAC Bypass via DiskCleanup Scheduled Task Hijack>> |Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<uac-bypass-via-diskcleanup-scheduled-task-hijack, UAC Bypass via DiskCleanup Scheduled Task Hijack>> |Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
-|<<uac-bypass-via-icmluautil-elevated-com-interface, UAC Bypass via ICMLuaUtil Elevated COM Interface>> |Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<uac-bypass-via-icmluautil-elevated-com-interface, UAC Bypass via ICMLuaUtil Elevated COM Interface>> |Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
-|<<uac-bypass-via-windows-firewall-snap-in-hijack, UAC Bypass via Windows Firewall Snap-In Hijack>> |Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<uac-bypass-via-windows-firewall-snap-in-hijack, UAC Bypass via Windows Firewall Snap-In Hijack>> |Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<uid-elevation-from-previously-unknown-executable, UID Elevation from Previously Unknown Executable>> |Monitors for the elevation of regular user permissions to root permissions through a previously unknown executable. Attackers may attempt to evade detection by hijacking the execution flow and hooking certain functions/syscalls through a rootkit in order to provide easy access to root via a special modified command. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.6.0 |2
 
 |<<unauthorized-access-to-an-okta-application, Unauthorized Access to an Okta Application>> |Identifies unauthorized access attempts to Okta applications. |[Tactic: Initial Access], [Use Case: Identity and Access Audit], [Data Source: Okta] |8.10.0 |206
 
-|<<uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> |Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |106
+|<<uncommon-registry-persistence-change, Uncommon Registry Persistence Change>> |Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
 |<<unexpected-child-process-of-macos-screensaver-engine, Unexpected Child Process of macOS Screensaver Engine>> |Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Defend] |8.3.0 |107
 
@@ -1960,21 +1974,21 @@ and their rule type is `machine_learning`.
 
 |<<unsigned-bits-service-client-process, Unsigned BITS Service Client Process>> |Identifies an unsigned Windows Background Intelligent Transfer Service (BITS) client process. Attackers may abuse BITS functionality to download or upload data using the BITS service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
-|<<unsigned-dll-loaded-by-svchost, Unsigned DLL Loaded by Svchost>> |Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.4.0 |5
+|<<unsigned-dll-loaded-by-svchost, Unsigned DLL Loaded by Svchost>> |Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Tactic: Execution], [Data Source: Elastic Defend] |8.4.0 |6
 
 |<<unsigned-dll-loaded-by-a-trusted-process, Unsigned DLL Loaded by a Trusted Process>> |Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers may plant their payloads into the application folder and invoke the legitimate application to execute the payload, masking actions they perform under a legitimate, trusted, and potentially elevated system or software process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.4.0 |101
 
-|<<unsigned-dll-side-loading-from-a-suspicious-folder, Unsigned DLL Side-Loading from a Suspicious Folder>> |Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.4.0 |7
+|<<unsigned-dll-side-loading-from-a-suspicious-folder, Unsigned DLL Side-Loading from a Suspicious Folder>> |Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend] |8.4.0 |8
 
-|<<untrusted-driver-loaded, Untrusted Driver Loaded>> |Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |6
+|<<untrusted-driver-loaded, Untrusted Driver Loaded>> |Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |7
 
 |<<unusual-aws-command-for-a-user, Unusual AWS Command for a User>> |A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data. |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.9.0 |208
 
-|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<unusual-child-process-from-a-system-virtual-process, Unusual Child Process from a System Virtual Process>> |Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |109
+|<<unusual-child-process-of-dns-exe, Unusual Child Process of dns.exe>> |Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |110
 
-|<<unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> |Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<unusual-child-processes-of-rundll32, Unusual Child Processes of RunDLL32>> |Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<unusual-city-for-an-aws-command, Unusual City For an AWS Command>> |A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s). |[Domain: Cloud], [Data Source: AWS], [Data Source: Amazon Web Services], [Rule Type: ML], [Rule Type: Machine Learning], [Resources: Investigation Guide] |8.9.0 |208
 
@@ -1988,11 +2002,11 @@ and their rule type is `machine_learning`.
 
 |<<unusual-discovery-signal-alert-with-unusual-process-executable, Unusual Discovery Signal Alert with Unusual Process Executable>> |This rule leverages Discovery building block rule alert data to alert on signals with unusual unique host.id, user.id and process.executable entries. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: Higher-Order Rule] |8.6.0 |2
 
-|<<unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> |Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<unusual-executable-file-creation-by-a-system-critical-process, Unusual Executable File Creation by a System Critical Process>> |Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
-|<<unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> |Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |113
+|<<unusual-file-creation-alternate-data-stream, Unusual File Creation - Alternate Data Stream>> |Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |114
 
-|<<unusual-file-modification-by-dns-exe, Unusual File Modification by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<unusual-file-modification-by-dns-exe, Unusual File Modification by dns.exe>> |Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Endgame], [Use Case: Vulnerability], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
 |<<unusual-hour-for-a-user-to-logon, Unusual Hour for a User to Logon>> |A machine learning job detected a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access], [Resources: Investigation Guide] |8.3.0 |104
 
@@ -2026,15 +2040,15 @@ and their rule type is `machine_learning`.
 
 |<<unusual-network-destination-domain-name, Unusual Network Destination Domain Name>> |A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication. |[Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning] |8.3.0 |103
 
-|<<unusual-parent-process-for-cmd-exe, Unusual Parent Process for cmd.exe>> |Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<unusual-parent-process-for-cmd-exe, Unusual Parent Process for cmd.exe>> |Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
-|<<unusual-parent-child-relationship, Unusual Parent-Child Relationship>> |Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<unusual-parent-child-relationship, Unusual Parent-Child Relationship>> |Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<unusual-persistence-via-services-registry, Unusual Persistence via Services Registry>> |Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
+|<<unusual-persistence-via-services-registry, Unusual Persistence via Services Registry>> |Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
-|<<unusual-print-spooler-child-process, Unusual Print Spooler Child Process>> |Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |107
+|<<unusual-print-spooler-child-process, Unusual Print Spooler Child Process>> |Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation], [Use Case: Vulnerability], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<unusual-process-execution-path-alternate-data-stream, Unusual Process Execution Path - Alternate Data Stream>> |Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
+|<<unusual-process-execution-path-alternate-data-stream, Unusual Process Execution Path - Alternate Data Stream>> |Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
 |<<unusual-process-execution-on-wbem-path, Unusual Process Execution on WBEM Path>> |Identifies unusual processes running from the WBEM path, uncommon outside WMI-related Windows processes. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
@@ -2048,11 +2062,11 @@ and their rule type is `machine_learning`.
 
 |<<unusual-process-network-connection, Unusual Process Network Connection>> |Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |107
 
-|<<unusual-process-spawned-by-a-host, Unusual Process Spawned by a Host>> |A machine learning job has detected a suspicious Windows process. This process has been classified as suspicious in two ways. It was predicted to be suspicious by the ProblemChild supervised ML model, and it was found to be an unusual process, on a host that does not commonly manifest malicious activity. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<unusual-process-spawned-by-a-host, Unusual Process Spawned by a Host>> |A machine learning job has detected a suspicious Windows process. This process has been classified as suspicious in two ways. It was predicted to be suspicious by the ProblemChild supervised ML model, and it was found to be an unusual process, on a host that does not commonly manifest malicious activity. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<unusual-process-spawned-by-a-parent-process, Unusual Process Spawned by a Parent Process>> |A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be an unusual child process name, for the parent process, by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<unusual-process-spawned-by-a-parent-process, Unusual Process Spawned by a Parent Process>> |A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be an unusual child process name, for the parent process, by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
-|<<unusual-process-spawned-by-a-user, Unusual Process Spawned by a User>> |A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |3
+|<<unusual-process-spawned-by-a-user, Unusual Process Spawned by a User>> |A machine learning job has detected a suspicious Windows process. This process has been classified as malicious in two ways. It was predicted to be malicious by the ProblemChild supervised ML model, and it was found to be suspicious given that its user context is unusual and does not commonly manifest malicious activity,by an unsupervised ML model. Such a process may be an instance of suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. |[Domain: Endpoint], [OS: Windows], [Use Case: Living off the Land Attack Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Defense Evasion] |8.9.0 |4
 
 |<<unusual-process-writing-data-to-an-external-device, Unusual Process Writing Data to an External Device>> |A machine learning job has detected a rare process writing data to an external device. Malicious actors often use benign-looking processes to mask their data exfiltration activities. The discovery of such a process that has no legitimate reason to write data to external devices can indicate exfiltration. |[Use Case: Data Exfiltration Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Exfiltration] |8.9.0 |3
 
@@ -2062,7 +2076,7 @@ and their rule type is `machine_learning`.
 
 |<<unusual-remote-file-size, Unusual Remote File Size>> |A machine learning job has detected an unusually high file size shared by a remote host indicating potential lateral movement activity. One of the primary goals of attackers after gaining access to a network is to locate and exfiltrate valuable information. Instead of multiple small transfers that can raise alarms, attackers might choose to bundle data into a single large file transfer. |[Use Case: Lateral Movement Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Lateral Movement] |8.9.0 |3
 
-|<<unusual-service-host-child-process-childless-service, Unusual Service Host Child Process - Childless Service>> |Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
+|<<unusual-service-host-child-process-childless-service, Unusual Service Host Child Process - Childless Service>> |Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Privilege Escalation], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
 
 |<<unusual-source-ip-for-a-user-to-logon-from, Unusual Source IP for a User to Logon from>> |A machine learning job detected a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts. |[Use Case: Identity and Access Audit], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |103
 
@@ -2092,7 +2106,7 @@ and their rule type is `machine_learning`.
 
 |<<unusual-windows-username, Unusual Windows Username>> |A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Rule Type: ML], [Rule Type: Machine Learning], [Tactic: Initial Access] |8.3.0 |104
 
-|<<user-account-creation, User Account Creation>> |Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
+|<<user-account-creation, User Account Creation>> |Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
 
 |<<user-added-as-owner-for-azure-application, User Added as Owner for Azure Application>> |Identifies when a user is added as an owner for an Azure application. An adversary may add a user account as an owner for an Azure application in order to grant additional permissions and modify the application's configuration using another account. |[Domain: Cloud], [Data Source: Azure], [Use Case: Configuration Audit], [Tactic: Persistence] |8.3.0 |102
 
@@ -2106,7 +2120,7 @@ and their rule type is `machine_learning`.
 
 |<<vnc-virtual-network-computing-to-the-internet, VNC (Virtual Network Computing) to the Internet>> |This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. |[Tactic: Command and Control], [Domain: Endpoint], [Use Case: Threat Detection] |8.3.0 |104
 
-|<<veeam-backup-library-loaded-by-unusual-process, Veeam Backup Library Loaded by Unusual Process>> |Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |1
+|<<veeam-backup-library-loaded-by-unusual-process, Veeam Backup Library Loaded by Unusual Process>> |Identifies potential credential decrypt operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library. Attackers can use Veeam Credentials to target backups as part of destructive operations such as Ransomware attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |2
 
 |<<virtual-machine-fingerprinting, Virtual Machine Fingerprinting>> |An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware. |[Domain: Endpoint], [OS: Linux], [Use Case: Threat Detection], [Tactic: Discovery], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |108
 
@@ -2114,11 +2128,11 @@ and their rule type is `machine_learning`.
 
 |<<virtual-private-network-connection-attempt, Virtual Private Network Connection Attempt>> |Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend] |8.3.0 |107
 
-|<<volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> |Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<volume-shadow-copy-deleted-or-resized-via-vssadmin, Volume Shadow Copy Deleted or Resized via VssAdmin>> |Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<volume-shadow-copy-deletion-via-powershell, Volume Shadow Copy Deletion via PowerShell>> |Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<volume-shadow-copy-deletion-via-powershell, Volume Shadow Copy Deletion via PowerShell>> |Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
-|<<volume-shadow-copy-deletion-via-wmic, Volume Shadow Copy Deletion via WMIC>> |Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<volume-shadow-copy-deletion-via-wmic, Volume Shadow Copy Deletion via WMIC>> |Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Impact], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<wmi-incoming-lateral-movement, WMI Incoming Lateral Movement>> |Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |109
 
@@ -2136,7 +2150,7 @@ and their rule type is `machine_learning`.
 
 |<<web-application-suspicious-activity-sqlmap-user-agent, Web Application Suspicious Activity: sqlmap User Agent>> |This is an example of how to detect an unwanted web client user agent. This search matches the user agent for sqlmap 1.3.11, which is a popular FOSS tool for testing web applications for SQL injection vulnerabilities. |[Data Source: APM] |8.3.0 |102
 
-|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<web-shell-detection-script-process-child-of-common-web-processes, Web Shell Detection: Script Process Child of Common Web Processes>> |Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<webproxy-settings-modification, WebProxy Settings Modification>> |Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection. |[Domain: Endpoint], [OS: macOS], [Use Case: Threat Detection], [Tactic: Credential Access], [Data Source: Elastic Defend] |8.3.0 |106
 
@@ -2144,35 +2158,35 @@ and their rule type is `machine_learning`.
 
 |<<werfault-reflectdebugger-persistence, Werfault ReflectDebugger Persistence>> |Identifies the registration of a Werfault Debugger. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed with the "-pr" parameter. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |1
 
-|<<whoami-process-activity, Whoami Process Activity>> |Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
+|<<whoami-process-activity, Whoami Process Activity>> |Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |111
 
 |<<windows-account-or-group-discovery, Windows Account or Group Discovery>> |This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |3
 
 |<<windows-cryptoapi-spoofing-vulnerability-cve-2020-0601-curveball, Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall)>> |A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Use Case: Vulnerability] |8.3.0 |104
 
-|<<windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> |Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<windows-defender-disabled-via-registry-modification, Windows Defender Disabled via Registry Modification>> |Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
-|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<windows-defender-exclusions-added-via-powershell, Windows Defender Exclusions Added via PowerShell>> |Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<windows-event-logs-cleared, Windows Event Logs Cleared>> |Identifies attempts to clear Windows event log stores. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Resources: Investigation Guide] |8.3.0 |108
 
-|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |109
+|<<windows-firewall-disabled-via-powershell, Windows Firewall Disabled via PowerShell>> |Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |110
 
 |<<windows-installer-with-suspicious-properties, Windows Installer with Suspicious Properties>> |Identifies the execution of an installer from an archive or with suspicious properties. Adversaries may abuse msiexec.exe to launch local or network accessible MSI files in an attempt to bypass application whitelisting. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Rule Type: BBR], [Data Source: Elastic Defend] |8.3.0 |1
 
 |<<windows-network-enumeration, Windows Network Enumeration>> |Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Tactic: Collection], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Rule Type: BBR] |8.3.0 |110
 
-|<<windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> |Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |107
+|<<windows-registry-file-creation-in-smb-share, Windows Registry File Creation in SMB Share>> |Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Lateral Movement], [Tactic: Credential Access], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |108
 
-|<<windows-script-executing-powershell, Windows Script Executing PowerShell>> |Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |110
+|<<windows-script-executing-powershell, Windows Script Executing PowerShell>> |Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Resources: Investigation Guide], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |111
 
 |<<windows-script-interpreter-executing-process-via-wmi, Windows Script Interpreter Executing Process via WMI>> |Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Initial Access], [Tactic: Execution], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |108
 
 |<<windows-service-installed-via-an-unusual-client, Windows Service Installed via an Unusual Client>> |Identifies the creation of a Windows service by an unusual client process. Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges from administrator to SYSTEM. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Privilege Escalation] |8.3.0 |108
 
-|<<windows-subsystem-for-linux-distribution-installed, Windows Subsystem for Linux Distribution Installed>> |Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |6
+|<<windows-subsystem-for-linux-distribution-installed, Windows Subsystem for Linux Distribution Installed>> |Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend], [Data Source: Sysmon] |8.3.0 |7
 
-|<<windows-subsystem-for-linux-enabled-via-dism-utility, Windows Subsystem for Linux Enabled via Dism Utility>> |Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |6
+|<<windows-subsystem-for-linux-enabled-via-dism-utility, Windows Subsystem for Linux Enabled via Dism Utility>> |Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Defense Evasion], [Data Source: Elastic Endgame], [Data Source: Elastic Defend] |8.3.0 |7
 
 |<<windows-system-information-discovery, Windows System Information Discovery>> |Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Discovery], [Rule Type: BBR], [Data Source: Elastic Defend], [Data Source: Elastic Endgame] |8.3.0 |3
 
@@ -2180,7 +2194,7 @@ and their rule type is `machine_learning`.
 
 |<<windows-user-account-creation, Windows User Account Creation>> |Identifies attempts to create a Windows User Account. This is sometimes done by attackers to persist or increase access to a system or domain. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Persistence] |None |1
 
-|<<wireless-credential-dumping-using-netsh-command, Wireless Credential Dumping using Netsh Command>> |Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |7
+|<<wireless-credential-dumping-using-netsh-command, Wireless Credential Dumping using Netsh Command>> |Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh. |[Domain: Endpoint], [OS: Windows], [Use Case: Threat Detection], [Tactic: Credential Access], [Tactic: Discovery], [Data Source: Elastic Endgame], [Resources: Investigation Guide], [Data Source: Elastic Defend] |8.3.0 |8
 
 |<<zoom-meeting-with-no-passcode, Zoom Meeting with no Passcode>> |This rule identifies Zoom meetings that are created without a passcode. Meetings without a passcode are susceptible to Zoombombing. Zoombombing is carried out by taking advantage of Zoom sessions that are not protected with a passcode. Zoombombing refers to the unwanted, disruptive intrusion, generally by Internet trolls and hackers, into a video conference call. In a typical Zoombombing incident, a teleconferencing session is hijacked by the insertion of material that is lewd, obscene, racist, or antisemitic in nature, typically resulting of the shutdown of the session. |[Data Source: Zoom], [Use Case: Configuration Audit], [Tactic: Initial Access] |8.3.0 |103
 
diff --git a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
index 3833d022ab..e960f5efd5 100644
--- a/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-desc-index.asciidoc
@@ -183,6 +183,7 @@ include::rule-details/creation-of-hidden-login-item-via-apple-script.asciidoc[]
 include::rule-details/creation-of-hidden-shared-object-file.asciidoc[]
 include::rule-details/creation-of-kernel-module.asciidoc[]
 include::rule-details/creation-of-settingcontent-ms-files.asciidoc[]
+include::rule-details/creation-of-a-dns-named-record.asciidoc[]
 include::rule-details/creation-of-a-hidden-local-user-account.asciidoc[]
 include::rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc[]
 include::rule-details/creation-or-modification-of-root-certificate.asciidoc[]
@@ -201,7 +202,6 @@ include::rule-details/default-cobalt-strike-team-server-certificate.asciidoc[]
 include::rule-details/delayed-execution-via-ping.asciidoc[]
 include::rule-details/delete-volume-usn-journal-with-fsutil.asciidoc[]
 include::rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc[]
-include::rule-details/deprecated-remote-file-creation-on-a-sensitive-directory.asciidoc[]
 include::rule-details/direct-outbound-smb-connection.asciidoc[]
 include::rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc[]
 include::rule-details/disable-windows-firewall-rules-via-netsh.asciidoc[]
@@ -552,6 +552,7 @@ include::rule-details/port-forwarding-rule-addition.asciidoc[]
 include::rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc[]
 include::rule-details/possible-fin7-dga-command-and-control-behavior.asciidoc[]
 include::rule-details/possible-okta-dos-attack.asciidoc[]
+include::rule-details/potential-adidns-poisoning-via-wildcard-record-creation.asciidoc[]
 include::rule-details/potential-admin-group-account-addition.asciidoc[]
 include::rule-details/potential-antimalware-scan-interface-bypass-via-powershell.asciidoc[]
 include::rule-details/potential-application-shimming-via-sdbinst.asciidoc[]
@@ -585,6 +586,7 @@ include::rule-details/potential-disabling-of-selinux.asciidoc[]
 include::rule-details/potential-enumeration-via-active-directory-web-service.asciidoc[]
 include::rule-details/potential-evasion-via-filter-manager.asciidoc[]
 include::rule-details/potential-evasion-via-windows-filtering-platform.asciidoc[]
+include::rule-details/potential-execution-via-xzbackdoor.asciidoc[]
 include::rule-details/potential-exploitation-of-an-unquoted-service-path-vulnerability.asciidoc[]
 include::rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc[]
 include::rule-details/potential-file-transfer-via-certreq.asciidoc[]
@@ -638,6 +640,7 @@ include::rule-details/potential-persistence-via-periodic-tasks.asciidoc[]
 include::rule-details/potential-persistence-via-time-provider-modification.asciidoc[]
 include::rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc[]
 include::rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc[]
+include::rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-localhost-secure-copy.asciidoc[]
 include::rule-details/potential-privacy-control-bypass-via-tccdb-modification.asciidoc[]
 include::rule-details/potential-privilege-escalation-through-writable-docker-socket.asciidoc[]
@@ -791,6 +794,7 @@ include::rule-details/sunburst-command-and-control-activity.asciidoc[]
 include::rule-details/scheduled-task-created-by-a-windows-script.asciidoc[]
 include::rule-details/scheduled-task-execution-at-scale-via-gpo.asciidoc[]
 include::rule-details/scheduled-tasks-at-command-enabled.asciidoc[]
+include::rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc[]
 include::rule-details/screensaver-plist-file-modified-by-unexpected-process.asciidoc[]
 include::rule-details/sedebugprivilege-enabled-by-a-suspicious-process.asciidoc[]
 include::rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc[]
@@ -845,6 +849,7 @@ include::rule-details/suspicious-net-reflection-via-powershell.asciidoc[]
 include::rule-details/suspicious-proc-maps-discovery.asciidoc[]
 include::rule-details/suspicious-apt-package-manager-execution.asciidoc[]
 include::rule-details/suspicious-apt-package-manager-network-connection.asciidoc[]
+include::rule-details/suspicious-access-to-ldap-attributes.asciidoc[]
 include::rule-details/suspicious-activity-reported-by-okta-user.asciidoc[]
 include::rule-details/suspicious-antimalware-scan-interface-dll.asciidoc[]
 include::rule-details/suspicious-automator-workflows-execution.asciidoc[]
@@ -879,6 +884,7 @@ include::rule-details/suspicious-imagepath-service-creation.asciidoc[]
 include::rule-details/suspicious-inter-process-communication-via-outlook.asciidoc[]
 include::rule-details/suspicious-interactive-shell-spawned-from-inside-a-container.asciidoc[]
 include::rule-details/suspicious-java-child-process.asciidoc[]
+include::rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc[]
 include::rule-details/suspicious-kworker-uid-elevation.asciidoc[]
 include::rule-details/suspicious-lsass-access-via-malseclogon.asciidoc[]
 include::rule-details/suspicious-lsass-process-access.asciidoc[]
@@ -913,6 +919,7 @@ include::rule-details/suspicious-rdp-activex-client-loaded.asciidoc[]
 include::rule-details/suspicious-remote-registry-access-via-sebackupprivilege.asciidoc[]
 include::rule-details/suspicious-renaming-of-esxi-files.asciidoc[]
 include::rule-details/suspicious-renaming-of-esxi-index-html-file.asciidoc[]
+include::rule-details/suspicious-screenconnect-client-child-process.asciidoc[]
 include::rule-details/suspicious-script-object-execution.asciidoc[]
 include::rule-details/suspicious-service-was-installed-in-the-system.asciidoc[]
 include::rule-details/suspicious-solarwinds-child-process.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
index 4d6a3646c2..c3516fad7a 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-discovery-command-via-system-account.asciidoc
@@ -8,7 +8,7 @@ Identifies when the SYSTEM account uses an account discovery utility. This could
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: low
@@ -34,7 +34,7 @@ Identifies when the SYSTEM account uses an account discovery utility. This could
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
index 99b2aa601d..a50f50bfa4 100644
--- a/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/account-password-reset-remotely.asciidoc
@@ -36,7 +36,7 @@ Identifies an attempt to reset a potentially privileged account password remotel
 * Tactic: Persistence
 * Tactic: Impact
 
-*Version*: 112
+*Version*: 114
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
index 34af2e95fe..ef7eb94205 100644
--- a/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adding-hidden-file-attribute-via-attrib.asciidoc
@@ -8,7 +8,7 @@ Adversaries can add the 'hidden' attribute to files to hide them from the user i
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Adversaries can add the 'hidden' attribute to files to hide them from the user i
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
index 551d0924d1..d115b66d5e 100644
--- a/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adfind-command-activity.asciidoc
@@ -7,7 +7,7 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -42,7 +42,7 @@ This rule detects the Active Directory query tool, AdFind.exe. AdFind has legiti
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
index c6e1ed8e09..b84db7c4b0 100644
--- a/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/adobe-hijack-persistence.asciidoc
@@ -8,7 +8,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Detects writing executable files that will be automatically launched by Adobe on
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
index b7d4f55182..0717806d6d 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempt-to-install-kali-linux-via-wsl.asciidoc
@@ -8,7 +8,7 @@ Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. A
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. A
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
index 3bf2280836..e353b3d292 100644
--- a/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/attempts-to-brute-force-a-microsoft-365-user-account.asciidoc
@@ -31,7 +31,7 @@ Identifies attempts to brute force a Microsoft 365 user account. An adversary ma
 * Use Case: Identity and Access Audit
 * Tactic: Credential Access
 
-*Version*: 106
+*Version*: 207
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
index afa309a7b9..e2bbdb3e29 100644
--- a/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/bypass-uac-via-event-viewer.asciidoc
@@ -8,7 +8,7 @@ Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
index 6a1fdcdf81..d23dfc1c0c 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-console-history.asciidoc
@@ -8,7 +8,7 @@ Identifies when a user attempts to clear console history. An adversary may clear
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -40,7 +40,7 @@ Identifies when a user attempts to clear console history. An adversary may clear
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
index 15361ff24d..1376cf864d 100644
--- a/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/clearing-windows-event-logs.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies attempts to clear or disable Windows event log stores using Windows w
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
index 4657a1bd14..f6f1772ef3 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-built-in-tools.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to disable/modify the code signing policy through system nat
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies attempts to disable/modify the code signing policy through system nat
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
index 8cdc987349..d78859bdb9 100644
--- a/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/code-signing-policy-modification-through-registry.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to disable the code signing policy through the registry. Cod
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies attempts to disable the code signing policy through the registry. Cod
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
index f264682ad3..c74b343b80 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-execution-via-solarwinds-process.asciidoc
@@ -8,7 +8,7 @@ A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
index afd5b18d86..cd4f9df9c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/command-shell-activity-started-via-rundll32.asciidoc
@@ -8,7 +8,7 @@ Identifies command shell activity started via RunDLL32, which is commonly abused
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies command shell activity started via RunDLL32, which is commonly abused
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
index 08ad5977bf..9c5bc8542c 100644
--- a/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/component-object-model-hijacking.asciidoc
@@ -7,7 +7,7 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 
 *Severity*: medium
 
@@ -35,7 +35,7 @@ Identifies Component Object Model (COM) hijacking via registry modification. Adv
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
index 5e60eb08ef..c041903e06 100644
--- a/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/conhost-spawned-by-suspicious-parent-process.asciidoc
@@ -8,7 +8,7 @@ Detects when the Console Window Host (conhost.exe) process is spawned by a suspi
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -39,7 +39,7 @@ Detects when the Console Window Host (conhost.exe) process is spawned by a suspi
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
index 49d54b3545..200b3b1b65 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-free-ssl-certificate-providers.asciidoc
@@ -8,7 +8,7 @@ Identifies unusual processes connecting to domains using known free SSL certific
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.network-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: low
@@ -32,7 +32,7 @@ Identifies unusual processes connecting to domains using known free SSL certific
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
index 96a9f618ae..d5a73d330a 100644
--- a/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/connection-to-commonly-abused-web-services.asciidoc
@@ -7,7 +7,7 @@ Adversaries may implement command and control (C2) communications that use commo
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.network-*
 
 *Severity*: low
 
@@ -30,7 +30,7 @@ Adversaries may implement command and control (C2) communications that use commo
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
@@ -115,21 +115,25 @@ network where host.os.type == "windows" and network.protocol == "dns" and
     process.name != null and user.id not in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
     /* Add new WebSvc domains here */
     dns.question.name :
-    (
+       (
         "raw.githubusercontent.*",
-        "*.pastebin.*",
-        "*drive.google.*",
-        "*docs.live.*",
-        "*api.dropboxapi.*",
-        "*dropboxusercontent.*",
-        "*onedrive.*",
-        "*4shared.*",
-        "*.file.io",
-        "*filebin.net",
-        "*slack-files.com",
-        "*ghostbin.*",
-        "*ngrok.*",
-        "*portmap.*",
+        "github.com",
+        "pastebin.*",
+        "paste4btc.com",
+        "paste.ee",
+        "ghostbin.com",
+        "drive.google.com",
+        "?.docs.live.net",
+        "api.dropboxapi.*",
+        "content.dropboxapi.*",
+        "dl.dropboxusercontent.*",
+        "api.onedrive.com",
+        "*.onedrive.org",
+        "onedrive.live.com",
+        "filebin.net",
+        "*.ngrok.io",
+        "ngrok.com",
+        "*.portmap.*",
         "*serveo.net",
         "*localtunnel.me",
         "*pagekite.me",
@@ -140,12 +144,55 @@ network where host.os.type == "windows" and network.protocol == "dns" and
         "zerobin.net",
         "controlc.com",
         "requestbin.net",
+        "slack.com",
+        "api.slack.com",
+        "slack-redir.net",
+        "slack-files.com",
         "cdn.discordapp.com",
         "discordapp.com",
         "discord.com",
+        "apis.azureedge.net",
+        "cdn.sql.gg",
+        "?.top4top.io",
+        "top4top.io",
+        "www.uplooder.net",
+        "*.cdnmegafiles.com",
+        "transfer.sh",
+        "gofile.io",
+        "updates.peer2profit.com",
+        "api.telegram.org",
+        "t.me",
+        "meacz.gq",
+        "rwrd.org",
+        "*.publicvm.com",
+        "*.blogspot.com",
+        "api.mylnikov.org",
+        "file.io",
+        "stackoverflow.com",
+        "*files.1drv.com",
+        "api.anonfile.com",
+        "*hosting-profi.de",
+        "ipbase.com",
+        "ipfs.io",
+        "*up.freeo*.space",
+        "api.mylnikov.org",
         "script.google.com",
-        "script.googleusercontent.com"
-    ) and
+        "script.googleusercontent.com",
+        "api.notion.com",
+        "graph.microsoft.com",
+        "*.sharepoint.com",
+        "mbasic.facebook.com",
+        "login.live.com",
+        "api.gofile.io",
+        "api.anonfiles.com",
+        "api.notion.com",
+        "api.trello.com",
+        "gist.githubusercontent.com",
+        "files.pythonhosted.org",
+        "g.live.com",
+        "*.zulipchat.com",
+        "graph.microsoft.com") and 
+        
     /* Insert noisy false positives here */
     not (
       (
diff --git a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
index 57a3bec3b9..c90b391b6e 100644
--- a/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/control-panel-process-with-unusual-arguments.asciidoc
@@ -7,7 +7,7 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -37,7 +37,7 @@ Identifies unusual instances of Control Panel with suspicious keywords or paths
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-dns-named-record.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-dns-named-record.asciidoc
new file mode 100644
index 0000000000..d2e2d091d2
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-dns-named-record.asciidoc
@@ -0,0 +1,95 @@
+[[creation-of-a-dns-named-record]]
+=== Creation of a DNS-Named Record
+
+Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues because of the default permission (Any authenticated users) to create DNS-named records. Attackers can perform Dynamic Spoofing attacks, where they monitor LLMNR/NBT-NS requests and create DNS-named records to target systems that are requested from multiple systems. They can also create specific records to target specific services, such as wpad, for spoofing attacks.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: low
+
+*Risk score*: 21
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.netspi.com/blog/technical/network-penetration-testing/adidns-revisited/
+* https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/wpad-spoofing
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Use Case: Active Directory Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and event.action == "Directory Service Changes" and
+    event.code == "5137" and winlog.event_data.ObjectClass == "dnsNode" and
+    not winlog.event_data.SubjectUserName : "*$"
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
index 07a5b5efa0..1bfede9d42 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation of a hidden local user account by appending the dollar s
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the creation of a hidden local user account by appending the dollar s
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
index 3e48acdfba..ad8b5a2d3e 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-a-new-gpo-scheduled-task-or-service.asciidoc
@@ -8,7 +8,7 @@ Detects the creation or modification of a new Group Policy based scheduled task
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Detects the creation or modification of a new Group Policy based scheduled task
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
index 68e450f29b..737b8fa047 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-domain-backup-dpapi-private-key.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies the creation or modification of Domain Backup private keys. Adversari
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
index 9ac6e0e303..81dd066401 100644
--- a/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/creation-or-modification-of-root-certificate.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation or modification of a local trusted root certificate in W
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the creation or modification of a local trusted root certificate in W
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
index e2adc673de..1a13b17478 100644
--- a/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/credential-acquisition-via-registry-hive-dumping.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to export a registry hive which may contain credentials usin
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies attempts to export a registry hive which may contain credentials usin
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
index c2ad7a21a8..c1a1806cd1 100644
--- a/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/delete-volume-usn-journal-with-fsutil.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
index 7cc5565c6c..b529b077f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/deleting-backup-catalogs-with-wbadmin.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and o
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and o
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
index d6621c2ca7..e11ef3eef8 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-event-and-security-logs-using-built-in-tools.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies attempts to disable EventLog via the logman Windows utility, PowerShe
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
index 230c05928b..04fbd6cb10 100644
--- a/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disable-windows-firewall-rules-via-netsh.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the netsh.exe to disable or weaken the local firewall. Attacke
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
index c860d3da46..d9073a9d1a 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-user-account-control-via-registry-modification.asciidoc
@@ -8,7 +8,7 @@ User Account Control (UAC) can help mitigate the impact of malware on Windows ho
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -39,7 +39,7 @@ User Account Control (UAC) can help mitigate the impact of malware on Windows ho
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
index 9b560ff739..3b74ced071 100644
--- a/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/disabling-windows-defender-security-settings-via-powershell.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies use of the Set-MpPreference PowerShell command to disable or weaken c
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
index d04db677af..6bce6db15d 100644
--- a/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/dns-over-https-enabled-via-registry.asciidoc
@@ -8,7 +8,7 @@ Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
index 3118d80dfc..e71fca5f02 100644
--- a/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enable-host-network-discovery-via-netsh.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the netsh.exe program to enable host discovery via the network
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the netsh.exe program to enable host discovery via the network
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
index 0844a11beb..1265231cb6 100644
--- a/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encoded-executable-stored-in-the-registry.asciidoc
@@ -7,7 +7,7 @@ Identifies registry write modifications to hide an encoded portable executable.
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -33,7 +33,7 @@ Identifies registry write modifications to hide an encoded portable executable.
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
index 05f3d2fc1b..954b5a1420 100644
--- a/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/encrypting-files-with-winrar-or-7z.asciidoc
@@ -7,7 +7,7 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies use of WinRar or 7z to create an encrypted files. Adversaries will of
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
index 935295d2d0..91daf0bbda 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-dsquery-exe.asciidoc
@@ -8,7 +8,7 @@ Identifies the use of dsquery.exe for domain trust discovery purposes. Adversari
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies the use of dsquery.exe for domain trust discovery purposes. Adversari
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
index d53bcd677c..a4ef8f7e03 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumerating-domain-trusts-via-nltest-exe.asciidoc
@@ -8,7 +8,7 @@ Identifies the use of nltest.exe for domain trust discovery purposes. Adversarie
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies the use of nltest.exe for domain trust discovery purposes. Adversarie
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
index 1b89f2783b..daa58230f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-command-spawned-via-wmiprvse.asciidoc
@@ -8,7 +8,7 @@ Identifies native Windows host and network enumeration commands spawned by the W
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ Identifies native Windows host and network enumeration commands spawned by the W
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
index 6e0c7bc462..62018e3b6b 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-administrator-accounts.asciidoc
@@ -7,7 +7,7 @@ Identifies instances of lower privilege accounts enumerating Administrator accou
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -35,7 +35,7 @@ Identifies instances of lower privilege accounts enumerating Administrator accou
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
index ed4e425663..3a8a1803e0 100644
--- a/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/enumeration-of-privileged-local-groups-membership.asciidoc
@@ -31,7 +31,7 @@ Identifies instances of an unusual process enumerating built-in Windows privileg
 * Tactic: Discovery
 * Resources: Investigation Guide
 
-*Version*: 211
+*Version*: 311
 
 *Rule authors*: 
 
@@ -144,39 +144,36 @@ host.os.type:windows and event.category:iam and event.action:user-member-enumera
     winlog.event_data.SubjectUserName: *$ or
     winlog.event_data.SubjectUserSid: ("S-1-5-19" or "S-1-5-20") or 
     winlog.event_data.CallerProcessName:("-" or 
-                                       *\:\\\\Windows\\\\System32\\\\VSSVC.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\SearchIndexer.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\CompatTelRunner.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\oobe\\\\msoobe.exe or
-                                       *\:\\\\Windows\\\\System32\\\\net1.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\svchost.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\Netplwiz.exe or 
-                                       *\:\\\\Windows\\\\System32\\\\msiexec.exe or
-                                       *\:\\\\Windows\\\\System32\\\\CloudExperienceHostBroker.exe or
-                                       *\:\\\\Windows\\\\System32\\\\RuntimeBroker.exe or
-                                       *\:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe or
-                                       *\:\\\\Windows\\\\System32\\\\SrTasks.exe or
-                                       *\:\\\\Windows\\\\System32\\\\diskshadow.exe or
-                                       *\:\\\\Windows\\\\System32\\\\dfsrs.exe or
-                                       *\:\\\\Windows\\\\System32\\\\vssadmin.exe or
-                                       *\:\\\\Windows\\\\System32\\\\dllhost.exe or
-                                       *\:\\\\Windows\\\\System32\\\\mmc.exe or
-                                       *\:\\\\Windows\\\\System32\\\\SettingSyncHost.exe or
-                                       *\:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe or
-                                       *\:\\\\Windows\\\\System32\\\\wsmprovhost.exe or
-                                       *\:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\x3jobt3?.exe or
-                                       *\:\\\\Windows\\\\System32\\\\mstsc.exe or
-                                       *\:\\\\Windows\\\\System32\\\\esentutl.exe or
-                                       *\:\\\\Windows\\\\System32\\\\RecoveryDrive.exe or
-                                       *\:\\\\Windows\\\\System32\\\\SystemPropertiesComputerName.exe or
-                                       *\:\\\\Windows\\\\SysWOW64\\\\msiexec.exe or
-                                       *\:\\\\Windows\\\\ImmersiveControlPanel\\\\SystemSettings.exe or
-                                       *\:\\\\Windows\\\\Temp\\\\rubrik_vmware???\\\\snaptool.exe or
-                                       *\:\\\\Windows\\\\VeeamVssSupport\\\\VeeamGuestHelper.exe or
-                                       ?\:\\\\WindowsAzure\\\\*WaAppAgent.exe or
-                                       ?\:\\\\Program?Files?\(x86\)\\\\*.exe or
-                                       ?\:\\\\Program?Files\\\\*.exe or
-                                       ?\:\\\\$WINDOWS.~BT\\\\Sources\\\\*.exe
+                                       C\:\\Windows\\System32\\VSSVC.exe or 
+                                       C\:\\Windows\\System32\\SearchIndexer.exe or 
+                                       C\:\\Windows\\System32\\CompatTelRunner.exe or 
+                                       C\:\\Windows\\System32\\oobe\\msoobe.exe or
+                                       C\:\\Windows\\System32\\net1.exe or 
+                                       C\:\\Windows\\System32\\svchost.exe or 
+                                       C\:\\Windows\\System32\\Netplwiz.exe or 
+                                       C\:\\Windows\\System32\\msiexec.exe or
+                                       C\:\\Windows\\System32\\CloudExperienceHostBroker.exe or
+                                       C\:\\Windows\\System32\\RuntimeBroker.exe or
+                                       C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe or
+                                       C\:\\Windows\\System32\\SrTasks.exe or
+                                       C\:\\Windows\\System32\\diskshadow.exe or
+                                       C\:\\Windows\\System32\\dfsrs.exe or
+                                       C\:\\Windows\\System32\\vssadmin.exe or
+                                       C\:\\Windows\\System32\\dllhost.exe or
+                                       C\:\\Windows\\System32\\mmc.exe or
+                                       C\:\\Windows\\System32\\SettingSyncHost.exe or
+                                       C\:\\Windows\\System32\\inetsrv\\w3wp.exe or
+                                       C\:\\Windows\\System32\\wsmprovhost.exe or
+                                       C\:\\Windows\\System32\\mstsc.exe or
+                                       C\:\\Windows\\System32\\esentutl.exe or
+                                       C\:\\Windows\\System32\\RecoveryDrive.exe or
+                                       C\:\\Windows\\System32\\SystemPropertiesComputerName.exe or
+                                       C\:\\Windows\\SysWOW64\\msiexec.exe or
+                                       C\:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe or
+                                       C\:\\Windows\\Temp\\rubrik_vmware*\\snaptool.exe or
+                                       C\:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe or
+                                       C\:\\WindowsAzure\\*WaAppAgent.exe or
+                                       C\:\\$WINDOWS.~BT\\Sources\\*.exe
                                       )
   )
 
diff --git a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
index c86ae862d4..93584abb4d 100644
--- a/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exchange-mailbox-export-via-powershell.asciidoc
@@ -35,7 +35,7 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 8
+*Version*: 108
 
 *Rule authors*: 
 
@@ -102,14 +102,7 @@ Attackers can abuse this functionality in preparation for exfiltrating contents,
 [source, js]
 ----------------------------------
 event.category:process and host.os.type:windows and
-  powershell.file.script_block_text : "New-MailboxExportRequest" and
-  not (
-    file.path : (
-      ?\:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Exchange\\\\RemotePowerShell\\\\* or
-      ?\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\tmp_????????.???\\\\tmp_????????.???.ps?1* or
-      ?\:\\\\Windows\\\\TEMP\\\\tmp_????????.???\\\\tmp_????????.???.ps?1*
-    ) and file.name:(*.psd1 or *.psm1)
-  )
+  powershell.file.script_block_text : "New-MailboxExportRequest"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
index 5536d169d9..a85d66c8de 100644
--- a/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/executable-file-creation-with-multiple-extensions.asciidoc
@@ -8,7 +8,7 @@ Masquerading can allow an adversary to evade defenses and better blend in with t
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -34,7 +34,7 @@ Masquerading can allow an adversary to evade defenses and better blend in with t
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
index 06958730c0..d8f9cffa52 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-from-unusual-directory-command-line.asciidoc
@@ -8,7 +8,7 @@ Identifies process execution from suspicious default Windows directories. This m
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies process execution from suspicious default Windows directories. This m
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
index 7683a97272..9e34ce9922 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-com-object-via-xwizard.asciidoc
@@ -8,7 +8,7 @@ Windows Component Object Model (COM) is an inter-process communication (IPC) com
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Windows Component Object Model (COM) is an inter-process communication (IPC) com
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
index 90219c97d7..89dbcecf8b 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-of-persistent-suspicious-program.asciidoc
@@ -8,7 +8,7 @@ Identifies execution of suspicious persistent programs (scripts, rundll32, etc.)
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -34,7 +34,7 @@ Identifies execution of suspicious persistent programs (scripts, rundll32, etc.)
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
index accd9e7bc3..4b38a06c8d 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-local-sxs-shared-module.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation, change, or deletion of a DLL module within a Windows Sx
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies the creation, change, or deletion of a DLL module within a Windows Sx
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
index 416c437751..ac743c94d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-mssql-xp-cmdshell-stored-procedure.asciidoc
@@ -8,7 +8,7 @@ Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
index 5f4353934f..d84a5830c7 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-tsclient-mountpoint.asciidoc
@@ -7,7 +7,7 @@ Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint ts
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint ts
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
index 2aded1ac21..3e1af2337f 100644
--- a/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/execution-via-windows-subsystem-for-linux.asciidoc
@@ -8,7 +8,7 @@ Detects attempts to execute a program on the host from the Windows Subsystem for
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Detects attempts to execute a program on the host from the Windows Subsystem for
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
index f5fa7f1791..09bd35eacf 100644
--- a/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/expired-or-revoked-driver-loaded.asciidoc
@@ -7,7 +7,7 @@ Identifies an attempt to load a revoked or expired driver. Adversaries may bring
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -32,7 +32,7 @@ Identifies an attempt to load a revoked or expired driver. Adversaries may bring
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
index c8ba959e8d..c164891164 100644
--- a/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/exporting-exchange-mailbox-via-powershell.asciidoc
@@ -7,7 +7,7 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -39,7 +39,7 @@ Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest,
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
index 22335b7994..f3728efb50 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-commonly-abused-remote-access-tool-execution.asciidoc
@@ -7,9 +7,11 @@ Adversaries may install legitimate remote access tools (RAT) to compromised endp
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
+* endgame-*
 * winlogbeat-*
 * logs-windows.*
+* logs-system.security*
 
 *Severity*: medium
 
@@ -25,6 +27,7 @@ Adversaries may install legitimate remote access tools (RAT) to compromised endp
 
 * https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/
 * https://attack.mitre.org/techniques/T1219/
+* https://github.com/redcanaryco/surveyor/blob/master/definitions/remote-admin.json
 
 *Tags*: 
 
@@ -34,8 +37,9 @@ Adversaries may install legitimate remote access tools (RAT) to compromised endp
 * Tactic: Command and Control
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
+* Data Source: Elastic Endgame
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
@@ -101,20 +105,193 @@ host.os.type: "windows" and
    event.category: "process" and event.type : "start" and
 
     (
-    process.code_signature.subject_name : (
-        TeamViewer* or "NetSupport Ltd" or "GlavSoft" or "LogMeIn, Inc." or "Ammyy LLC" or
-        "Nanosystems S.r.l." or "Remote Utilities LLC" or "ShowMyPC" or "Splashtop Inc." or
-        "Yakhnovets Denis Aleksandrovich IP" or "Pro Softnet Corporation" or "BeamYourScreen GmbH" or
-        "RealVNC" or "uvnc" or "SAFIB") or
-
-    process.name.caseless : (
-        "teamviewer.exe" or "apc_Admin.exe" or "apc_host.exe" or "SupremoHelper.exe" or "rfusclient.exe" or
-        "spclink.exe" or "smpcview.exe" or "ROMServer.exe" or "strwinclt.exe" or "RPCSuite.exe" or "RemotePCDesktop.exe" or
-        "RemotePCService.exe" or "tvn.exe" or "LMIIgnition.exe" or "B4-Service.exe" or "Mikogo-Service.exe" or "AnyDesk.exe" or
-        "Splashtop-streamer.exe" or AA_v*.exe, or "rutserv.exe" or "rutview.exe" or "vncserver.exe" or "vncviewer.exe" or
-        "tvnserver.exe" or "tvnviewer.exe" or "winvnc.exe" or "RemoteDesktopManager.exe" or "LogMeIn.exe" or ScreenConnect*.exe or
-        "RemotePC.exe" or "r_server.exe" or "radmin.exe" or "ROMServer.exe" or "ROMViewer.exe" or "DWRCC.exe" or "AeroAdmin.exe" or
-        "ISLLightClient.exe" or "ISLLight.exe" or "AteraAgent.exe" or "SRService.exe")
+        process.code_signature.subject_name : (
+            "Action1 Corporation" or
+            "AeroAdmin LLC" or
+            "Ammyy LLC" or
+            "Atera Networks Ltd" or
+            "AWERAY PTE. LTD." or
+            "BeamYourScreen GmbH" or
+            "Bomgar Corporation" or
+            "DUC FABULOUS CO.,LTD" or
+            "DOMOTZ INC." or
+            "DWSNET OÜ" or
+            "FleetDeck Inc" or
+            "GlavSoft LLC" or
+            "GlavSoft LLC." or
+            "Hefei Pingbo Network Technology Co. Ltd" or
+            "IDrive, Inc." or
+            "IMPERO SOLUTIONS LIMITED" or
+            "Instant Housecall" or
+            "ISL Online Ltd." or
+            "LogMeIn, Inc." or
+            "Monitoring Client" or
+            "MMSOFT Design Ltd." or
+            "Nanosystems S.r.l." or
+            "NetSupport Ltd" or
+            "NinjaRMM, LLC" or
+            "Parallels International GmbH" or
+            "philandro Software GmbH" or
+            "Pro Softnet Corporation" or
+            "RealVNC" or
+            "RealVNC Limited" or
+            "BreakingSecurity.net" or
+            "Remote Utilities LLC" or
+            "Rocket Software, Inc." or
+            "SAFIB" or
+            "Servably, Inc." or
+            "ShowMyPC INC" or
+            "Splashtop Inc." or
+            "Superops Inc." or
+            "TeamViewer" or
+            "TeamViewer GmbH" or
+            "TeamViewer Germany GmbH" or
+            "Techinline Limited" or
+            "uvnc bvba" or
+            "Yakhnovets Denis Aleksandrovich IP" or
+            "Zhou Huabing"
+        ) or
+
+        process.name.caseless : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        ) or
+        process.name : (
+            AA_v*.exe or
+            "AeroAdmin.exe" or
+            "AnyDesk.exe" or
+            "apc_Admin.exe" or
+            "apc_host.exe" or
+            "AteraAgent.exe" or
+            aweray_remote*.exe or
+            "AweSun.exe" or
+            "B4-Service.exe" or
+            "BASupSrvc.exe" or
+            "bomgar-scc.exe" or
+            "domotzagent.exe" or
+            "domotz-windows-x64-10.exe" or
+            "dwagsvc.exe" or
+            "DWRCC.exe" or
+            "ImperoClientSVC.exe" or
+            "ImperoServerSVC.exe" or
+            "ISLLight.exe" or
+            "ISLLightClient.exe" or
+            fleetdeck_commander*.exe or
+            "getscreen.exe" or
+            "LMIIgnition.exe" or
+            "LogMeIn.exe" or
+            "ManageEngine_Remote_Access_Plus.exe" or
+            "Mikogo-Service.exe" or
+            "NinjaRMMAgent.exe" or
+            "NinjaRMMAgenPatcher.exe" or
+            "ninjarmm-cli.exe" or
+            "r_server.exe" or
+            "radmin.exe" or
+            "radmin3.exe" or
+            "RCClient.exe" or
+            "RCService.exe" or
+            "RemoteDesktopManager.exe" or
+            "RemotePC.exe" or
+            "RemotePCDesktop.exe" or
+            "RemotePCService.exe" or
+            "rfusclient.exe" or
+            "ROMServer.exe" or
+            "ROMViewer.exe" or
+            "RPCSuite.exe" or
+            "rserver3.exe" or
+            "rustdesk.exe" or
+            "rutserv.exe" or
+            "rutview.exe" or
+            "saazapsc.exe" or
+            ScreenConnect*.exe or
+            "smpcview.exe" or
+            "spclink.exe" or
+            "Splashtop-streamer.exe" or
+            "SRService.exe" or
+            "strwinclt.exe" or
+            "Supremo.exe" or
+            "SupremoService.exe" or
+            "teamviewer.exe" or
+            "TiClientCore.exe" or
+            "TSClient.exe" or
+            "tvn.exe" or
+            "tvnserver.exe" or
+            "tvnviewer.exe" or
+            UltraVNC*.exe or
+            UltraViewer*.exe or
+            "vncserver.exe" or
+            "vncviewer.exe" or
+            "winvnc.exe" or
+            "winwvc.exe" or
+            "Zaservice.exe" or
+            "ZohoURS.exe"
+        )
 	) and
 
 	not (process.pe.original_file_name : ("G2M.exe" or "Updater.exe" or "powershell.exe") and process.code_signature.subject_name : "LogMeIn, Inc.")
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
index 186364fdda..a181841fbd 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-driver-loaded.asciidoc
@@ -7,7 +7,7 @@ Identifies the load of a driver with an original file name and signature values
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -33,7 +33,7 @@ Identifies the load of a driver with an original file name and signature values
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
index 2e3c82cd6e..a15e6ac707 100644
--- a/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/first-time-seen-removable-device.asciidoc
@@ -7,7 +7,7 @@ Identifies newly seen removable devices by device friendly name using registry m
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -38,7 +38,7 @@ Identifies newly seen removable devices by device friendly name using registry m
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc b/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
index ec1578757f..5b78e68795 100644
--- a/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/full-user-mode-dumps-enabled-system-wide.asciidoc
@@ -8,7 +8,7 @@ Identifies the enable of the full user-mode dumps feature system-wide. This feat
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the enable of the full user-mode dumps feature system-wide. This feat
 * Data Source: Elastic Endgame
 * Data Source: Sysmon
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
index f9ea827d2a..9d8514656c 100644
--- a/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/group-policy-discovery-via-microsoft-gpresult-utility.asciidoc
@@ -8,7 +8,7 @@ Detects the usage of gpresult.exe to query group policy objects. Attackers may q
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ Detects the usage of gpresult.exe to query group policy objects. Attackers may q
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
index f82b7767fb..ad7ecf7a81 100644
--- a/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/high-number-of-process-and-or-service-terminations.asciidoc
@@ -8,7 +8,7 @@ This rule identifies a high number (10) of process terminations (stop, delete, o
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ This rule identifies a high number (10) of process terminations (stop, delete, o
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
index f7f2f41444..02488bf66c 100644
--- a/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/iis-http-logging-disabled.asciidoc
@@ -8,7 +8,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies when Internet Information Services (IIS) HTTP Logging is disabled on
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc b/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
index f7cc8a1f55..163a2cc976 100644
--- a/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/image-file-execution-options-injection.asciidoc
@@ -7,7 +7,7 @@ The Debugger and SilentProcessExit registry keys can allow an adversary to inter
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -36,7 +36,7 @@ The Debugger and SilentProcessExit registry keys can allow an adversary to inter
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
index daae35eb98..241b1efef2 100644
--- a/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/imageload-via-windows-update-auto-update-client.asciidoc
@@ -7,7 +7,7 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -37,7 +37,7 @@ Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
index 102af14e3b..c7401a0ad1 100644
--- a/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ingress-transfer-via-windows-bits.asciidoc
@@ -7,7 +7,7 @@ Identifies downloads of executable and archive files via the Windows Background
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 
 *Severity*: low
 
@@ -32,7 +32,7 @@ Identifies downloads of executable and archive files via the Windows Background
 * Tactic: Command and Control
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc b/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
index 4073d9cb23..f1f1fb6810 100644
--- a/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installation-of-custom-shim-databases.asciidoc
@@ -7,7 +7,7 @@ Identifies the installation of custom Application Compatibility Shim databases.
 
 *Rule indices*: 
 
-* logs-endpoint.events.registry*
+* logs-endpoint.events.registry-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 
@@ -32,7 +32,7 @@ Identifies the installation of custom Application Compatibility Shim databases.
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
index f674671660..56de27f3e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/installation-of-security-support-provider.asciidoc
@@ -8,7 +8,7 @@ Identifies registry modifications related to the Windows Security Support Provid
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies registry modifications related to the Windows Security Support Provid
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
index 320861e536..c6cd8caa07 100644
--- a/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kerberos-traffic-from-unusual-process.asciidoc
@@ -7,7 +7,7 @@ Identifies network connections to the standard Kerberos port from an unusual pro
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.network-*
 
 *Severity*: medium
 
@@ -30,7 +30,7 @@ Identifies network connections to the standard Kerberos port from an unusual pro
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/kirbi-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/kirbi-file-creation.asciidoc
index 1190f9434e..e60ee80ee9 100644
--- a/docs/detections/prebuilt-rules/rule-details/kirbi-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/kirbi-file-creation.asciidoc
@@ -7,7 +7,7 @@ Identifies the creation of .kirbi files. The creation of this kind of file is an
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: medium
@@ -31,7 +31,7 @@ Identifies the creation of .kirbi files. The creation of this kind of file is an
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
index 63a92b5635..56be641950 100644
--- a/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lateral-movement-via-startup-folder.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious file creations in the startup folder of a remote system. A
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies suspicious file creations in the startup folder of a remote system. A
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
index b1dcaf39f2..e4b8c9e299 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-group-creation.asciidoc
@@ -7,6 +7,7 @@ Identifies attempts to create a new group. Attackers may create new groups to es
 
 *Rule indices*: 
 
+* filebeat-*
 * logs-system.auth-*
 
 *Severity*: low
@@ -29,7 +30,7 @@ Identifies attempts to create a new group. Attackers may create new groups to es
 * Tactic: Persistence
 * Resources: Investigation Guide
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
index 732790d5b4..54fbd48318 100644
--- a/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/linux-user-account-creation.asciidoc
@@ -7,6 +7,7 @@ Identifies attempts to create new users. Attackers may add new users to establis
 
 *Rule indices*: 
 
+* filebeat-*
 * logs-system.auth-*
 
 *Severity*: low
@@ -29,7 +30,7 @@ Identifies attempts to create new users. Attackers may add new users to establis
 * Tactic: Persistence
 * Resources: Investigation Guide
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
index 1f721fcdbc..e95c4a0f7c 100644
--- a/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/local-account-tokenfilter-policy-disabled.asciidoc
@@ -8,7 +8,7 @@ Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -39,7 +39,7 @@ Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
index e13f10fad9..4565fb7cc3 100644
--- a/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/local-scheduled-task-creation.asciidoc
@@ -8,7 +8,7 @@ Indicates the creation of a scheduled task. Adversaries can use these to establi
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: low
@@ -35,7 +35,7 @@ Indicates the creation of a scheduled task. Adversaries can use these to establi
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
index c0f5a1aec8..8bcea6f2f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-memory-dump-creation.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation of a Local Security Authority Subsystem Service (lsass.e
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the creation of a Local Security Authority Subsystem Service (lsass.e
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
index 6f79883e2f..9d773da84a 100644
--- a/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/lsass-process-access-via-windows-api.asciidoc
@@ -7,7 +7,7 @@ Identifies access attempts to the LSASS handle, which may indicate an attempt to
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.api-*
 
 *Severity*: medium
 
@@ -32,7 +32,7 @@ Identifies access attempts to the LSASS handle, which may indicate an attempt to
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
index 78c74b99b3..e2be5d6857 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-predicted-to-be-malicious-activity.asciidoc
@@ -36,7 +36,7 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -78,9 +78,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
diff --git a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
index 0638739990..13b2bfe6d6 100644
--- a/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/machine-learning-detected-a-suspicious-windows-event-with-a-high-malicious-probability-score.asciidoc
@@ -36,7 +36,7 @@ A supervised machine learning model (ProblemChild) has identified a suspicious W
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -78,9 +78,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
index 9e172f3ea0..1fc71ad4db 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-policy-deletion.asciidoc
@@ -32,7 +32,7 @@ Identifies the deletion of an anti-phishing policy in Microsoft 365. By default,
 * Use Case: Configuration Audit
 * Tactic: Initial Access
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
index 712cd5c336..fedc9bd4de 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-anti-phish-rule-modification.asciidoc
@@ -32,7 +32,7 @@ Identifies the modification of an anti-phishing rule in Microsoft 365. By defaul
 * Use Case: Configuration Audit
 * Tactic: Initial Access
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
index 42ac763877..d49d2eb2a2 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dkim-signing-configuration-disabled.asciidoc
@@ -30,7 +30,7 @@ Identifies when a DomainKeys Identified Mail (DKIM) signing configuration is dis
 * Data Source: Microsoft 365
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
index 5cf85bc621..23e35ccf29 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-dlp-policy-removed.asciidoc
@@ -32,7 +32,7 @@ Identifies when a Data Loss Prevention (DLP) policy is removed in Microsoft 365.
 * Use Case: Configuration Audit
 * Tactic: Defense Evasion
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
index eb340cffd2..63dfd57229 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-policy-deletion.asciidoc
@@ -31,7 +31,7 @@ Identifies when a malware filter policy has been deleted in Microsoft 365. A mal
 * Use Case: Configuration Audit
 * Tactic: Defense Evasion
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
index e7be6387b7..b6127da4d4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-malware-filter-rule-modification.asciidoc
@@ -32,7 +32,7 @@ Identifies when a malware filter rule has been deleted or disabled in Microsoft
 * Use Case: Configuration Audit
 * Tactic: Defense Evasion
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
index 7136fcb5ee..4e403f0837 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-management-group-role-assignment.asciidoc
@@ -32,7 +32,7 @@ Identifies when a new role is assigned to a management group in Microsoft 365. A
 * Use Case: Identity and Access Audit
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
index 4f0e5df97e..222f8ed210 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-attachment-rule-disabled.asciidoc
@@ -31,7 +31,7 @@ Identifies when a safe attachment rule is disabled in Microsoft 365. Safe attach
 * Use Case: Configuration Audit
 * Tactic: Defense Evasion
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
index fd1eb73870..ba13564570 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-safe-link-policy-disabled.asciidoc
@@ -32,7 +32,7 @@ Identifies when a Safe Link policy is disabled in Microsoft 365. Safe Link polic
 * Use Case: Identity and Access Audit
 * Tactic: Initial Access
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
index 23d9edb681..321728f3ff 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-creation.asciidoc
@@ -32,7 +32,7 @@ Identifies a transport rule creation in Microsoft 365. As a best practice, Excha
 * Use Case: Configuration Audit
 * Tactic: Exfiltration
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
index 71f14e8cfe..ef1b4f21a5 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-exchange-transport-rule-modification.asciidoc
@@ -33,7 +33,7 @@ Identifies when a transport rule has been disabled or deleted in Microsoft 365.
 * Use Case: Configuration Audit
 * Tactic: Exfiltration
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
index baa6939927..70666088e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-global-administrator-role-assigned.asciidoc
@@ -31,7 +31,7 @@ In Azure Active Directory (Azure AD), permissions to manage resources are assign
 * Use Case: Identity and Access Audit
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
index 22b065e254..af217503d2 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-inbox-forwarding-rule-created.asciidoc
@@ -34,7 +34,7 @@ Identifies when a new Inbox forwarding rule is created in Microsoft 365. Inbox r
 * Use Case: Configuration Audit
 * Tactic: Collection
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
index 6c59072200..62cc9e6f9e 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-potential-ransomware-activity.asciidoc
@@ -32,7 +32,7 @@ Identifies when Microsoft Cloud App Security reports that a user has uploaded fi
 * Use Case: Configuration Audit
 * Tactic: Impact
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
index 6b5fdb28db..e6b4daead8 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-custom-application-interaction-allowed.asciidoc
@@ -31,7 +31,7 @@ Identifies when custom applications are allowed in Microsoft Teams. If an organi
 * Use Case: Configuration Audit
 * Tactic: Persistence
 
-*Version*: 106
+*Version*: 207
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
index 7bd58339f2..bc82a213bf 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-external-access-enabled.asciidoc
@@ -31,7 +31,7 @@ Identifies when external access is enabled in Microsoft Teams. External access l
 * Use Case: Configuration Audit
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
index 901335abce..075a7825df 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-teams-guest-access-enabled.asciidoc
@@ -31,7 +31,7 @@ Identifies when guest access is enabled in Microsoft Teams. Guest access in Team
 * Use Case: Configuration Audit
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
index e7f8e11bc4..5d1a541924 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-unusual-volume-of-file-deletion.asciidoc
@@ -32,7 +32,7 @@ Identifies that a user has deleted an unusually large volume of files as reporte
 * Use Case: Configuration Audit
 * Tactic: Impact
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
index 1739fd5b78..c91074b5c2 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-365-user-restricted-from-sending-email.asciidoc
@@ -32,7 +32,7 @@ Identifies when a user has been restricted from sending email due to exceeding s
 * Use Case: Configuration Audit
 * Tactic: Initial Access
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
index c2a1f15ee9..71ba46d50c 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-an-unusual-process.asciidoc
@@ -8,7 +8,7 @@ An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * logs-system.security*
 
@@ -35,7 +35,7 @@ An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 210
+*Version*: 211
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
index 28c962ccad..4b514f2bbb 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-script-process.asciidoc
@@ -8,7 +8,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 
 *Severity*: low
@@ -32,7 +32,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by a script or t
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 208
+*Version*: 209
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
index 053034a7dd..1e6b4cb6bb 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-a-system-process.asciidoc
@@ -8,7 +8,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or t
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
index eceff987af..92a312854d 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-started-by-an-office-application.asciidoc
@@ -8,7 +8,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
index 5d27332ea3..8ce2eadee4 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-build-engine-using-an-alternate-name.asciidoc
@@ -8,7 +8,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ An instance of MSBuild, the Microsoft Build Engine, was started after being rena
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
index e3075ddde5..7bf57ed14a 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-spawning-suspicious-processes.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server U
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -39,7 +39,7 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server U
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
index 3af7e6df0c..492f4ab6f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-server-um-writing-suspicious-files.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious files being written by the Microsoft Exchange Server Unifi
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -39,7 +39,7 @@ Identifies suspicious files being written by the Microsoft Exchange Server Unifi
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
index 957b5b2cf0..4bad1f231d 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-exchange-worker-spawning-suspicious-processes.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server w
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -39,7 +39,7 @@ Identifies suspicious processes being spawned by the Microsoft Exchange Server w
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
index 89fde46a00..4cd54013d1 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-connection-strings-decryption.asciidoc
@@ -8,7 +8,7 @@ Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
index 318671bf4f..61c28c916b 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-iis-service-account-password-dumped.asciidoc
@@ -8,7 +8,7 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies the Internet Information Services (IIS) command-line tool, AppCmd, be
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
index 6916a83b74..045e981903 100644
--- a/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/microsoft-windows-defender-tampering.asciidoc
@@ -8,7 +8,7 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: medium
@@ -42,7 +42,7 @@ Identifies when one or more features on Microsoft Defender are disabled. Adversa
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
index ce8c85eaf8..1ee3343f02 100644
--- a/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mimikatz-memssp-log-file-detected.asciidoc
@@ -8,7 +8,7 @@ Identifies the password log file from the default Mimikatz memssp module.
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies the password log file from the default Mimikatz memssp module.
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
index 1676813faf..abc0cbd0fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-amsienable-registry-key.asciidoc
@@ -8,7 +8,7 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies modifications of the AmsiEnable registry key to 0, which disables the
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
index d514786daa..cd39d00576 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-boot-configuration.asciidoc
@@ -8,7 +8,7 @@ Identifies use of bcdedit.exe to delete boot configuration data. This tactic is
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of bcdedit.exe to delete boot configuration data. This tactic is
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
index ed8a5b5c15..9a44251f34 100644
--- a/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/modification-of-wdigest-security-provider.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -40,7 +40,7 @@ Identifies attempts to modify the WDigest security provider in the registry to f
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
index 60d5259384..e665229ec6 100644
--- a/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/mounting-hidden-or-webdav-remote-shares.asciidoc
@@ -7,7 +7,7 @@ Identifies the use of net.exe to mount a WebDav or hidden remote share. This may
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -35,7 +35,7 @@ Identifies the use of net.exe to mount a WebDav or hidden remote share. This may
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
index 9dcb26dc8c..49dfe62730 100644
--- a/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/network-logon-provider-registry-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies the modification of the network logon provider registry. Adversaries
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -37,7 +37,7 @@ Identifies the modification of the network logon provider registry. Adversaries
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
index 5f538f1922..87ce6af264 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-activesyncalloweddeviceid-added-via-powershell.asciidoc
@@ -7,7 +7,7 @@ Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a n
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -38,7 +38,7 @@ Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a n
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
index a5cf81b645..94d820b51a 100644
--- a/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/new-or-modified-federation-domain.asciidoc
@@ -36,7 +36,7 @@ Identifies a new or modified federation domain, which can be used to create a tr
 * Use Case: Identity and Access Audit
 * Tactic: Privilege Escalation
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
index 51cbadb96f..46d7fd7bc0 100644
--- a/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/ntds-or-sam-database-file-copied.asciidoc
@@ -8,7 +8,7 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies a copy operation of the Active Directory Domain Database (ntds.dit) o
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
index 3f92a257e5..102b3dcbfd 100644
--- a/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/nullsessionpipe-registry-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies NullSessionPipe registry modifications that specify which pipes can b
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -37,7 +37,7 @@ Identifies NullSessionPipe registry modifications that specify which pipes can b
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
index 05617e51a8..7f603cf00f 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-email-reported-by-user-as-malware-or-phish.asciidoc
@@ -30,7 +30,7 @@ Detects the occurrence of emails reported as Phishing or Malware by Users. Secur
 * Data Source: Microsoft 365
 * Tactic: Initial Access
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
index 0326bb5dd9..4d47248876 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-excessive-single-sign-on-logon-errors.asciidoc
@@ -29,7 +29,7 @@ Identifies accounts with a high number of single sign-on (SSO) logon errors. Exc
 * Use Case: Identity and Access Audit
 * Tactic: Credential Access
 
-*Version*: 106
+*Version*: 207
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
index 82c8e076e9..097753d2e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-exchange-suspicious-mailbox-right-delegation.asciidoc
@@ -29,7 +29,7 @@ Identifies the assignment of rights to access content from another mailbox. An a
 * Use Case: Configuration Audit
 * Tactic: Persistence
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
index da1864089e..104a1cda96 100644
--- a/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/o365-mailbox-audit-logging-bypass.asciidoc
@@ -31,7 +31,7 @@ Detects the occurrence of mailbox audit bypass associations. The mailbox audit i
 * Tactic: Initial Access
 * Tactic: Defense Evasion
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
index 60993ef895..042d168864 100644
--- a/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/onedrive-malware-file-upload.asciidoc
@@ -30,7 +30,7 @@ Identifies the occurence of files uploaded to OneDrive being detected as Malware
 * Data Source: Microsoft 365
 * Tactic: Lateral Movement
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
index 445f267fec..b509e16723 100644
--- a/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/outbound-scheduled-task-activity-via-powershell.asciidoc
@@ -34,7 +34,7 @@ Identifies the PowerShell process loading the Task Scheduler COM DLL followed by
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
@@ -51,7 +51,7 @@ Identifies the PowerShell process loading the Task Scheduler COM DLL followed by
 sequence by host.id, process.entity_id with maxspan = 5s
  [any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
   (?dll.name : "taskschd.dll" or file.name : "taskschd.dll") and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe")]
- [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.ip in ("127.0.0.1", "::1")]
+ [network where host.os.type == "windows" and process.name : ("powershell.exe", "pwsh.exe", "powershell_ise.exe") and destination.port == 135 and not destination.address in ("127.0.0.1", "::1")]
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
index aa213c12fb..221158c10e 100644
--- a/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/parent-process-pid-spoofing.asciidoc
@@ -7,7 +7,7 @@ Identifies parent process spoofing used to thwart detection. Adversaries may spo
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: high
 
@@ -32,7 +32,7 @@ Identifies parent process spoofing used to thwart detection. Adversaries may spo
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
index cd37522fea..ee0c3f07a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/peripheral-device-discovery.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the Windows file system utility (fsutil.exe) to gather informa
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the Windows file system utility (fsutil.exe) to gather informa
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
index 95a2eefe44..b87dbe6abb 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-bits-job-notify-cmdline.asciidoc
@@ -7,7 +7,7 @@ An adversary can use the Background Intelligent Transfer Service (BITS) SetNotif
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -39,7 +39,7 @@ An adversary can use the Background Intelligent Transfer Service (BITS) SetNotif
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
index 6e86457351..cde532b5f0 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-hidden-run-key-detected.asciidoc
@@ -7,7 +7,7 @@ Identifies a persistence mechanism that utilizes the NtSetValueKey native API to
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -39,7 +39,7 @@ Identifies a persistence mechanism that utilizes the NtSetValueKey native API to
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
index d3bbd610c5..26076979ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-office-addins.asciidoc
@@ -7,7 +7,7 @@ Detects attempts to establish persistence on an endpoint by abusing Microsoft Of
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ Detects attempts to establish persistence on an endpoint by abusing Microsoft Of
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
index 490a76056c..b3c42fca85 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-microsoft-outlook-vba.asciidoc
@@ -7,7 +7,7 @@ Detects attempts to establish persistence on an endpoint by installing a rogue M
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -37,7 +37,7 @@ Detects attempts to establish persistence on an endpoint by installing a rogue M
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
index 05d8603552..580f6ec0b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-powershell-profile.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation or modification of a PowerShell profile. PowerShell prof
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the creation or modification of a PowerShell profile. PowerShell prof
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
index f4989e2eef..979060630a 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-scheduled-job-creation.asciidoc
@@ -8,7 +8,7 @@ A job can be used to schedule programs or scripts to be executed at a specified
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -34,7 +34,7 @@ A job can be used to schedule programs or scripts to be executed at a specified
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
index 20bc79b324..7be3dfe7fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-telemetrycontroller-scheduled-task-hijack.asciidoc
@@ -8,7 +8,7 @@ Detects the successful hijack of Microsoft Compatibility Appraiser scheduled tas
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Detects the successful hijack of Microsoft Compatibility Appraiser scheduled tas
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
index fa81153850..fbc236327b 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-update-orchestrator-service-hijack.asciidoc
@@ -8,7 +8,7 @@ Identifies potential hijacking of the Microsoft Update Orchestrator Service to e
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies potential hijacking of the Microsoft Update Orchestrator Service to e
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
index d7b2ba3dff..b2700c47be 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-event-subscription.asciidoc
@@ -7,7 +7,7 @@ An adversary can use Windows Management Instrumentation (WMI) to install event f
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -37,7 +37,7 @@ An adversary can use Windows Management Instrumentation (WMI) to install event f
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
index 8a122a9239..e9932c8a9c 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistence-via-wmi-standard-registry-provider.asciidoc
@@ -7,7 +7,7 @@ Identifies use of the Windows Management Instrumentation StdRegProv (registry pr
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 
 *Severity*: high
@@ -34,7 +34,7 @@ Identifies use of the Windows Management Instrumentation StdRegProv (registry pr
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
index bd79a8eaaa..2b08db1698 100644
--- a/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/persistent-scripts-in-the-startup-directory.asciidoc
@@ -8,7 +8,7 @@ Identifies script engines creating files in the Startup folder, or the creation
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.file*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies script engines creating files in the Startup folder, or the creation
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
index 81070c3fa5..162c846cbc 100644
--- a/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/port-forwarding-rule-addition.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies the creation of a new port forwarding rule. An adversary may abuse th
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
index a0540250c9..5c869e3012 100644
--- a/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/possible-consent-grant-attack-via-azure-registered-application.asciidoc
@@ -36,7 +36,7 @@ Detects when a user grants permissions to an Azure-registered application or whe
 * Resources: Investigation Guide
 * Tactic: Initial Access
 
-*Version*: 109
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-adidns-poisoning-via-wildcard-record-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
new file mode 100644
index 0000000000..895e2a8e17
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-adidns-poisoning-via-wildcard-record-creation.asciidoc
@@ -0,0 +1,94 @@
+[[potential-adidns-poisoning-via-wildcard-record-creation]]
+=== Potential ADIDNS Poisoning via Wildcard Record Creation
+
+Active Directory Integrated DNS (ADIDNS) is one of the core components of AD DS, leveraging AD's access control and replication to maintain domain consistency. It stores DNS zones as AD objects, a feature that, while robust, introduces some security issues, such as wildcard records, mainly because of the default permission (Any authenticated users) to create DNS-named records. Attackers can create wildcard records to redirect traffic that doesn't explicitly match records contained in the zone, becoming the Man-in-the-Middle and being able to abuse DNS similarly to LLMNR/NBNS spoofing.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.*
+* logs-windows.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.netspi.com/blog/technical/network-penetration-testing/exploiting-adidns/
+* https://www.thehacker.recipes/a-d/movement/mitm-and-coerced-authentications/adidns-spoofing
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Data Source: Active Directory
+* Use Case: Active Directory Monitoring
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+```
+
+The above policy does not cover the target object by default (we still need it to be configured to generate events), so we need to set up an AuditRule using https://github.com/OTRF/Set-AuditRule.
+
+```
+Set-AuditRule -AdObjectPath 'AD:\CN=MicrosoftDNS,DC=DomainDNSZones,DC=Domain,DC=com' -WellKnownSidType WorldSid -Rights CreateChild -InheritanceFlags Descendents -AttributeGUID e0fa1e8c-9b45-11d0-afdd-00c04fd930c9 -AuditFlags Success
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where host.os.type == "windows" and event.action == "Directory Service Changes" and
+    event.code == "5137" and startsWith(winlog.event_data.ObjectDN, "DC=*,")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
index 06c80a6a38..b56b22421f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-application-shimming-via-sdbinst.asciidoc
@@ -8,7 +8,7 @@ The Application Shim was created to allow for backward compatibility of software
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ The Application Shim was created to allow for backward compatibility of software
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
@@ -63,6 +63,7 @@ For more details on adding a custom ingest pipeline refer - https://www.elastic.
 [source, js]
 ----------------------------------
 process where host.os.type == "windows" and event.type == "start" and process.name : "sdbinst.exe" and
+  process.args : "?*" and
   not (process.args : "-m" and process.args : "-bg") and
   not process.args : "-mm"
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
index 995aa162f5..b7a6c35123 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-credential-access-via-windows-utilities.asciidoc
@@ -8,7 +8,7 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies the execution of known Windows utilities often abused to dump LSASS m
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
index 0dc7754bc8..820b6ab2a3 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-microsoft-antimalware-service-executable.asciidoc
@@ -8,7 +8,7 @@ Identifies a Windows trusted program that is known to be vulnerable to DLL Searc
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies a Windows trusted program that is known to be vulnerable to DLL Searc
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
index 0660188161..cbaf790a10 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dll-side-loading-via-trusted-microsoft-programs.asciidoc
@@ -8,7 +8,7 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies an instance of a Windows trusted program that is known to be vulnerab
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
index 07f1f77d7e..cbcccad5e2 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-dns-tunneling-via-nslookup.asciidoc
@@ -8,7 +8,7 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ This rule identifies a large number (15) of nslookup.exe executions with an expl
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
index f2d6ea16ae..b23f818c76 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-filter-manager.asciidoc
@@ -8,7 +8,7 @@ The Filter Manager Control Program (fltMC.exe) binary may be abused by adversari
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ The Filter Manager Control Program (fltMC.exe) binary may be abused by adversari
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
index ae4c40a8b3..b9d99df04a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-evasion-via-windows-filtering-platform.asciidoc
@@ -8,7 +8,7 @@ Identifies multiple Windows Filtering Platform block events and where the proces
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-windows.*
+* logs-windows.network-*
 * logs-system.security-*
 
 *Severity*: medium
@@ -37,7 +37,7 @@ Identifies multiple Windows Filtering Platform block events and where the proces
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-execution-via-xzbackdoor.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-execution-via-xzbackdoor.asciidoc
new file mode 100644
index 0000000000..ccdaca43f7
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-execution-via-xzbackdoor.asciidoc
@@ -0,0 +1,98 @@
+[[potential-execution-via-xzbackdoor]]
+=== Potential Execution via XZBackdoor
+
+It identifies potential malicious shell executions through remote SSH and detects cases where the sshd service suddenly terminates soon after successful execution, suggesting suspicious behavior similar to the XZ backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/amlweems/xzbot
+* https://access.redhat.com/security/cve/CVE-2024-3094
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Linux
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Tactic: Persistence
+* Tactic: Lateral Movement
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+sequence by host.id, user.id with maxspan=1s
+ [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "sshd" and
+    process.args == "-D" and process.args == "-R"] by process.pid, process.entity_id
+ [process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.parent.name == "sshd" and 
+  process.executable != "/usr/sbin/sshd"] by process.parent.pid, process.parent.entity_id
+ [process where host.os.type == "linux" and event.action == "end" and process.name == "sshd" and process.exit_code != 0] by process.pid, process.entity_id
+ [network where host.os.type == "linux" and event.type == "end" and event.action == "disconnect_received" and process.name == "sshd"] by process.pid, process.entity_id
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Persistence
+** ID: TA0003
+** Reference URL: https://attack.mitre.org/tactics/TA0003/
+* Technique:
+** Name: Create or Modify System Process
+** ID: T1543
+** Reference URL: https://attack.mitre.org/techniques/T1543/
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Modify Authentication Process
+** ID: T1556
+** Reference URL: https://attack.mitre.org/techniques/T1556/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Remote Services
+** ID: T1021
+** Reference URL: https://attack.mitre.org/techniques/T1021/
+* Sub-technique:
+** Name: SSH
+** ID: T1021.004
+** Reference URL: https://attack.mitre.org/techniques/T1021/004/
+* Technique:
+** Name: Remote Service Session Hijacking
+** ID: T1563
+** Reference URL: https://attack.mitre.org/techniques/T1563/
+* Sub-technique:
+** Name: SSH Hijacking
+** ID: T1563.001
+** Reference URL: https://attack.mitre.org/techniques/T1563/001/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
index bde0289981..95759e6540 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-external-linux-ssh-brute-force-detected.asciidoc
@@ -7,6 +7,7 @@ Identifies multiple external consecutive login failures targeting a user account
 
 *Rule indices*: 
 
+* filebeat-*
 * logs-system.auth-*
 
 *Severity*: low
@@ -28,7 +29,7 @@ Identifies multiple external consecutive login failures targeting a user account
 * Use Case: Threat Detection
 * Tactic: Credential Access
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
index 40620104e5..197a4fe982 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-file-transfer-via-certreq.asciidoc
@@ -8,7 +8,7 @@ Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
index ae0f1d9c92..a9cccd432e 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-internal-linux-ssh-brute-force-detected.asciidoc
@@ -7,6 +7,7 @@ Identifies multiple internal consecutive login failures targeting a user account
 
 *Rule indices*: 
 
+* filebeat-*
 * logs-system.auth-*
 
 *Severity*: medium
@@ -28,7 +29,7 @@ Identifies multiple internal consecutive login failures targeting a user account
 * Use Case: Threat Detection
 * Tactic: Credential Access
 
-*Version*: 10
+*Version*: 11
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
index d6cc21912c..f735f97bf1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-local-ntlm-relay-via-http.asciidoc
@@ -8,7 +8,7 @@ Identifies attempt to coerce a local NTLM authentication via HTTP using the Wind
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -39,7 +39,7 @@ Identifies attempt to coerce a local NTLM authentication via HTTP using the Wind
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
index c0bb5349b7..3fab405d51 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-lsa-authentication-package-abuse.asciidoc
@@ -7,7 +7,7 @@ Adversaries can use the autostart mechanism provided by the Local Security Autho
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 
 *Severity*: medium
@@ -31,7 +31,7 @@ Adversaries can use the autostart mechanism provided by the Local Security Autho
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 104
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
index a551b5c745..47d674a2b1 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-business-app-installer.asciidoc
@@ -7,7 +7,7 @@ Identifies executables with names resembling legitimate business applications bu
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: low
 
@@ -33,7 +33,7 @@ Identifies executables with names resembling legitimate business applications bu
 * Tactic: Initial Access
 * Tactic: Execution
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
index 6c36d2713d..0512a028cd 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-masquerading-as-communication-apps.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious instances of communications apps, both unsigned and rename
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: medium
 
@@ -29,7 +29,7 @@ Identifies suspicious instances of communications apps, both unsigned and rename
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
index 233753e166..3846679c56 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-modification-of-accessibility-binaries.asciidoc
@@ -8,7 +8,7 @@ Windows contains accessibility features that may be launched with a key combinat
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Windows contains accessibility features that may be launched with a key combinat
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
index 43bbdfacfc..fc68f9d1ec 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-password-spraying-of-microsoft-365-user-accounts.asciidoc
@@ -29,7 +29,7 @@ Identifies a high number (25) of failed Microsoft 365 user authentication attemp
 * Use Case: Identity and Access Audit
 * Tactic: Credential Access
 
-*Version*: 106
+*Version*: 207
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
index 533af0999d..a6d7ce5526 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-persistence-via-time-provider-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies modification of the Time Provider. Adversaries may establish persiste
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -36,7 +36,7 @@ Identifies modification of the Time Provider. Adversaries may establish persiste
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
index bb494539a7..72a0e1bc19 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-port-monitor-or-print-processor-registration-abuse.asciidoc
@@ -7,7 +7,7 @@ Identifies port monitor and print processor registry modifications. Adversaries
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 
 *Severity*: medium
@@ -33,7 +33,7 @@ Identifies port monitor and print processor registry modifications. Adversaries
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
index a14348d57d..01d2847330 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-hacktool-script-by-function-names.asciidoc
@@ -33,7 +33,7 @@ Detects known PowerShell offensive tooling functions names in PowerShell scripts
 * Tactic: Execution
 * Data Source: PowerShell Logs
 
-*Version*: 10
+*Version*: 111
 
 *Rule authors*: 
 
@@ -174,7 +174,7 @@ event.category:process and host.os.type:windows and
     "Find-ProcessDLLHijack" or "Find-RDPClientConnection" or
     "Get-AllAttributesForClass" or "Get-CachedGPPPassword" or
     "Get-DecryptedCpassword" or "Get-DecryptedSitelistPassword" or
-    "Get-DelegateType" or
+    "Get-DelegateType" or "New-RelayEnumObject" or
     "Get-DomainDFSShare" or "Get-DomainDFSShareV1" or
     "Get-DomainDFSShareV2" or "Get-DomainDNSRecord" or
     "Get-DomainDNSZone" or "Get-DomainFileServer" or
@@ -198,7 +198,7 @@ event.category:process and host.os.type:windows and
     "Get-GPPInnerFields" or "Get-GPPPassword" or
     "Get-GptTmpl" or "Get-GroupsXML" or
     "Get-HttpStatus" or "Get-ImageNtHeaders" or
-    "Get-Keystrokes" or
+    "Get-Keystrokes" or "New-SOASerialNumberArray" or 
     "Get-MemoryProcAddress" or "Get-MicrophoneAudio" or
     "Get-ModifiablePath" or "Get-ModifiableRegistryAutoRun" or
     "Get-ModifiableScheduledTaskFile" or "Get-ModifiableService" or
@@ -333,9 +333,6 @@ event.category:process and host.os.type:windows and
   not powershell.file.script_block_text : (
     "sentinelbreakpoints" and "Set-PSBreakpoint"
   ) and
-  not file.path : (
-    ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\DataCollection\\\\*
-  ) and
   not user.id : ("S-1-5-18" or "S-1-5-19")
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc
new file mode 100644
index 0000000000..eb0acf3f6f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/potential-powershell-pass-the-hash-relay-script.asciidoc
@@ -0,0 +1,123 @@
+[[potential-powershell-pass-the-hash-relay-script]]
+=== Potential PowerShell Pass-the-Hash/Relay Script
+
+Detects PowerShell scripts that can execute pass-the-hash (PtH) attacks, intercept and relay NTLM challenges, and carry out other man-in-the-middle (MitM) attacks.
+
+*Rule type*: query
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-windows.powershell*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-WMIExec.ps1
+* https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1
+* https://github.com/dafthack/Check-LocalAdminHash/blob/master/Check-LocalAdminHash.ps1
+* https://github.com/nettitude/PoshC2/blob/master/resources/modules/Invoke-Tater.ps1
+* https://github.com/Kevin-Robertson/Inveigh/blob/master/Inveigh.ps1
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Credential Access
+* Resources: Investigation Guide
+* Data Source: PowerShell Logs
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+
+*Setup*
+
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+event.category:process and host.os.type:windows and
+  powershell.file.script_block_text : (
+    ("NTLMSSPNegotiate" and ("NegotiateSMB" or "NegotiateSMB2")) or
+    "4E544C4D53535000" or
+    "0x4e,0x54,0x4c,0x4d,0x53,0x53,0x50" or
+    "0x4e,0x54,0x20,0x4c,0x4d" or
+    "0x53,0x4d,0x42,0x20,0x32" or
+    "0x81,0xbb,0x7a,0x36,0x44,0x98,0xf1,0x35,0xad,0x32,0x98,0xf0,0x38"
+  )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Credential Access
+** ID: TA0006
+** Reference URL: https://attack.mitre.org/tactics/TA0006/
+* Technique:
+** Name: Adversary-in-the-Middle
+** ID: T1557
+** Reference URL: https://attack.mitre.org/techniques/T1557/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Tactic:
+** Name: Lateral Movement
+** ID: TA0008
+** Reference URL: https://attack.mitre.org/tactics/TA0008/
+* Technique:
+** Name: Use Alternate Authentication Material
+** ID: T1550
+** Reference URL: https://attack.mitre.org/techniques/T1550/
+* Sub-technique:
+** Name: Pass the Hash
+** ID: T1550.002
+** Reference URL: https://attack.mitre.org/techniques/T1550/002/
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
index b57989dfff..287ca9c663 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-privilege-escalation-via-installerfiletakeover.asciidoc
@@ -7,7 +7,7 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: high
 
@@ -33,7 +33,7 @@ Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) defaul
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
index 37b2b75ea8..be83731103 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-credential-access-via-registry.asciidoc
@@ -7,7 +7,7 @@ Identifies remote access to the registry to potentially dump credential data fro
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 
 *Severity*: high
 
@@ -34,7 +34,7 @@ Identifies remote access to the registry to potentially dump credential data fro
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
index 0c2e1c9bf4..d6f1b8909f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-remote-desktop-tunneling-detected.asciidoc
@@ -7,7 +7,7 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -38,7 +38,7 @@ Identifies potential use of an SSH utility to establish RDP over a reverse SSH T
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
index a6209b12c1..69aab17d3f 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-secure-file-deletion-via-sdelete-utility.asciidoc
@@ -8,7 +8,7 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Detects file name patterns generated by the use of Sysinternals SDelete utility
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc b/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
index 99d0b365a6..f52f866a7a 100644
--- a/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/potential-successful-ssh-brute-force-attack.asciidoc
@@ -8,6 +8,7 @@ Identifies multiple SSH login failures followed by a successful one from the sam
 *Rule indices*: 
 
 * auditbeat-*
+* filebeat-*
 * logs-system.auth-*
 
 *Severity*: high
@@ -29,7 +30,7 @@ Identifies multiple SSH login failures followed by a successful one from the sam
 * Use Case: Threat Detection
 * Tactic: Credential Access
 
-*Version*: 10
+*Version*: 11
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
index d8800be1db..580759a198 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-psreflect-script.asciidoc
@@ -34,7 +34,7 @@ Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 110
+*Version*: 210
 
 *Rule authors*: 
 
@@ -167,8 +167,7 @@ event.category:process and host.os.type:windows and
     "Reflection.Emit.CustomAttributeBuilder" or
     "Runtime.InteropServices.DllImportAttribute"
   ) and
-  not user.id : "S-1-5-18" and
-  not file.path : ?\:\\\\ProgramData\\\\MaaS360\\\\Cloud?Extender\\\\AR\\\\Scripts\\\\ASModuleCommon.ps1*
+  not user.id : "S-1-5-18"
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
index 21f499b620..a7b919fc59 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-block-logging-disabled.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies attempts to disable PowerShell Script Block Logging via registry modi
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
index bbfab8b12f..b762f42557 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-archive-compression-capabilities.asciidoc
@@ -31,7 +31,7 @@ Identifies the use of Cmdlets and methods related to archive compression activit
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 5
+*Version*: 105
 
 *Rule authors*: 
 
@@ -86,13 +86,7 @@ event.category:process and host.os.type:windows and
     "ZipArchiveMode"
   ) or
   powershell.file.script_block_text : "Compress-Archive"
-) and 
-  not file.path : (
-        ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\Downloads\\\\* or
-        ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\DataCollection\\\\* or
-        ?\:\\\\Program?Files\\\\Microsoft?Dependency?Agent\\\\plugins\\\\* or
-        ?\:\\\\Program?Files\\\\Azure\\\\StorageSyncAgent\\\\AFSDiag.ps1
-      )
+)
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
index c7776acc17..6ce7555aa5 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-discovery-capabilities.asciidoc
@@ -32,7 +32,7 @@ Identifies the use of Cmdlets and methods related to discovery activities. Attac
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 6
+*Version*: 106
 
 *Rule authors*: 
 
@@ -162,24 +162,7 @@ event.category:process and host.os.type:windows and
     ) or
     "CmdletsToExport=@(\"Add-Content\","
   ) and
-  not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20") and
-  not file.path : (
-        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or
-        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psm1 or
-        ?\:\\\\Program?Files\\\\Microsoft?Azure?AD?Sync\\\\Extensions\\\\AADConnector.psm1* or
-        *ServiceNow?MID?Server*agent\\\\scripts\\\\PowerShell\\\\*.psm1 or
-        ?\:\\\\*\\\\IMECache\\\\HealthScripts\\\\*\\\\detect.ps1
-      ) and
-  not (
-    file.path : (
-      ?\:\\\\*\\\\TEMP\\\\SDIAG* or
-      ?\:\\\\TEMP\\\\SDIAG* or
-      ?\:\\\\Temp\\\\SDIAG* or
-      ?\:\\\\temp\\\\SDIAG* or
-      ?\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\SDIAG* or
-      ?\:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\*\\\\SDIAG*
-    ) and file.name : "CL_Utility.ps1"
-  )
+  not user.id : ("S-1-5-18" or "S-1-5-19" or "S-1-5-20")
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
index 9a09e5331a..6e45171ad2 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-log-clear-capabilities.asciidoc
@@ -34,7 +34,7 @@ Identifies the use of Cmdlets and methods related to Windows event log deletion
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 5
+*Version*: 105
 
 *Rule authors*: 
 
@@ -79,9 +79,6 @@ event.category:process and host.os.type:windows and
     ("Eventing.Reader.EventLogSession" and ".ClearLog") or
     ("Diagnostics.EventLog" and ".Clear")
   ) and
-  not file.path : (
-    ?\:\\\\*\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\Microsoft.PowerShell.Management\\\\*.psd1
-  ) and
   not powershell.file.script_block_text : (
     "CmdletsToExport=@(\"Add-Content\""
   )
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
index 361ab45c9a..c7c343e532 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-script-with-remote-execution-capabilities-via-winrm.asciidoc
@@ -36,7 +36,7 @@ Identifies the use of Cmdlets and methods related to remote execution activities
 * Data Source: PowerShell Logs
 * Rule Type: BBR
 
-*Version*: 6
+*Version*: 106
 
 *Rule authors*: 
 
@@ -80,11 +80,7 @@ event.category:process and host.os.type:windows and
   ) and
   not user.id : "S-1-5-18" and
   not file.directory : (
-    "C:\\Program Files\\LogicMonitor\\Agent\\tmp" or
-    ?\:\\\\Program?Files\\\\Microsoft\\\\Exchange?Server\\\\*\\\\bin or
-    ?\:\\\\Logicmonitor\\\\tmp* or
-    ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\dbatools\\\\* or
-    ?\:\\\\ExchangeServer\\\\bin*
+    "C:\\Program Files\\LogicMonitor\\Agent\\tmp"
   ) and not
   powershell.file.script_block_text : (
     "Export-ModuleMember -Function @('Invoke-Expression''Invoke-Command')" and
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
index 72ac13b62f..8a3d17a2f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-discovery-related-windows-api-functions.asciidoc
@@ -36,7 +36,7 @@ This rule detects the use of discovery-related Windows API functions in PowerShe
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 113
+*Version*: 213
 
 *Rule authors*: 
 
@@ -151,7 +151,6 @@ event.category:process and host.os.type:windows and
     NetScheduleJobEnum or
     NetUserModalsGet
   )
-  and not file.path : ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\DataCollection\\\\*
 
 ----------------------------------
 
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
index 5bc56b60ea..9bfa8afb2f 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-payload-encoded-and-compressed.asciidoc
@@ -31,7 +31,7 @@ Identifies the use of .NET functionality for decompression and base64 decoding c
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 111
+*Version*: 211
 
 *Rule authors*: 
 
@@ -154,7 +154,6 @@ event.category:process and host.os.type:windows and
     ) and
     FromBase64String
   ) and
-  not file.path: ?\:\\\\ProgramData\\\\Microsoft\\\\Windows?Defender?Advanced?Threat?Protection\\\\Downloads\\\\* and
   not user.id : "S-1-5-18"
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
index e3ab59d19b..5d1b53e5b6 100644
--- a/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/powershell-suspicious-script-with-clipboard-retrieval-capabilities.asciidoc
@@ -34,7 +34,7 @@ Detects PowerShell scripts that can get the contents of the clipboard, which att
 * Data Source: PowerShell Logs
 * Resources: Investigation Guide
 
-*Version*: 8
+*Version*: 108
 
 *Rule authors*: 
 
@@ -140,15 +140,8 @@ event.category:process and host.os.type:windows and
     "sentinelbreakpoints" and "Set-PSBreakpoint" and "PowerSploitIndicators"
   ) and
   not user.id : "S-1-5-18" and
-  not file.path : (
-        ?\:\\\\program?files\\\\powershell\\\\?\\\\Modules\\\\*.psd1 or
-        ?\:\\\\Windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or
-        ?\:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\Modules\\\\*.psd1 or
-        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psd1 or
-        ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\Modules\\\\*.psm1
-      ) and 
   not (
-    file.path : ?\:\\\\Program?Files\\\\WindowsPowerShell\\\\*Modules*.ps1 and
+    file.path : C\:\\Program?Files\\WindowsPowerShell\\*Modules*.ps1 and
     file.name : ("Convert-ExcelRangeToImage.ps1" or "Read-Clipboard.ps1")
   )
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
index ad9c0fedd0..61c31796c5 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-named-pipe-impersonation.asciidoc
@@ -8,7 +8,7 @@ Identifies a privilege escalation attempt via named pipe impersonation. An adver
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -39,7 +39,7 @@ Identifies a privilege escalation attempt via named pipe impersonation. An adver
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
index 3c94ca9198..7b208f89dd 100644
--- a/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privilege-escalation-via-windir-environment-variable.asciidoc
@@ -7,7 +7,7 @@ Identifies a privilege escalation attempt via a rogue Windows directory (Windir)
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -35,7 +35,7 @@ Identifies a privilege escalation attempt via a rogue Windows directory (Windir)
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc b/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
index 9dda5e487c..626e9394e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/privileges-elevation-via-parent-process-pid-spoofing.asciidoc
@@ -7,7 +7,7 @@ Identifies parent process spoofing used to create an elevated child process. Adv
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: high
 
@@ -34,7 +34,7 @@ Identifies parent process spoofing used to create an elevated child process. Adv
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
index bffecfee9a..246d688ebe 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-activity-via-compiled-html-file.asciidoc
@@ -8,7 +8,7 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTM
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
index f87183a3c8..925d7210c4 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-created-with-a-duplicated-token.asciidoc
@@ -7,7 +7,7 @@ Identifies the creation of a process impersonating the token of another user log
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: medium
 
@@ -31,7 +31,7 @@ Identifies the creation of a process impersonating the token of another user log
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
index 554c29232b..d6a5e6da50 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-created-with-an-elevated-token.asciidoc
@@ -7,7 +7,7 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 
 *Severity*: high
 
@@ -32,7 +32,7 @@ Identifies the creation of a process running as SYSTEM and impersonating a Windo
 * Tactic: Privilege Escalation
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
index e1e9d858d9..86b8746e28 100644
--- a/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/process-execution-from-an-unusual-directory.asciidoc
@@ -8,7 +8,7 @@ Identifies process execution from suspicious default Windows directories. This i
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ Identifies process execution from suspicious default Windows directories. This i
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
index 4a559c7c84..cdafeb8c1f 100644
--- a/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/program-files-directory-masquerading.asciidoc
@@ -8,7 +8,7 @@ Identifies execution from a directory masquerading as the Windows Program Files
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ Identifies execution from a directory masquerading as the Windows Program Files
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/query-registry-using-built-in-tools.asciidoc b/docs/detections/prebuilt-rules/rule-details/query-registry-using-built-in-tools.asciidoc
index b9b2b9cbca..e4f6d71998 100644
--- a/docs/detections/prebuilt-rules/rule-details/query-registry-using-built-in-tools.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/query-registry-using-built-in-tools.asciidoc
@@ -7,7 +7,7 @@ This rule identifies the execution of commands that can be used to query the Win
 
 *Rule indices*: 
 
-* logs-endpoint.events.process*
+* logs-endpoint.events.process-*
 
 *Severity*: low
 
@@ -30,7 +30,7 @@ This rule identifies the execution of commands that can be used to query the Win
 * Rule Type: BBR
 * Data Source: Elastic Defend
 
-*Version*: 103
+*Version*: 104
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/rare-smb-connection-to-the-internet.asciidoc b/docs/detections/prebuilt-rules/rule-details/rare-smb-connection-to-the-internet.asciidoc
index 6dd0478fb0..fe86f6fa54 100644
--- a/docs/detections/prebuilt-rules/rule-details/rare-smb-connection-to-the-internet.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rare-smb-connection-to-the-internet.asciidoc
@@ -7,7 +7,7 @@ This rule detects rare internet network connections via the SMB protocol. SMB is
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.network-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ This rule detects rare internet network connections via the SMB protocol. SMB is
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 2
+*Version*: 3
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
index e153db6c29..7d599eb710 100644
--- a/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/rdp-enabled-via-registry.asciidoc
@@ -7,7 +7,7 @@ Identifies registry write modifications to enable Remote Desktop Protocol (RDP)
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies registry write modifications to enable Remote Desktop Protocol (RDP)
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
index 4feedfcf4b..b1b68ca898 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appcert-dll.asciidoc
@@ -8,7 +8,7 @@ Detects attempts to maintain persistence by creating registry keys using AppCert
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Detects attempts to maintain persistence by creating registry keys using AppCert
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
index be9338a541..25b6195543 100644
--- a/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/registry-persistence-via-appinit-dll.asciidoc
@@ -8,7 +8,7 @@ AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every proces
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every proces
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
index d6e854dc82..624c6be4e1 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-desktop-enabled-in-windows-firewall-by-netsh.asciidoc
@@ -8,7 +8,7 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of the network shell utility (netsh.exe) to enable inbound Remote
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
index 55ecdd5b25..d053548140 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-to-a-hidden-share.asciidoc
@@ -7,7 +7,7 @@ Identifies a remote file copy attempt to a hidden network share. This may indica
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -34,7 +34,7 @@ Identifies a remote file copy attempt to a hidden network share. This may indica
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
index 24f333c8c4..9462a84c88 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc
@@ -7,7 +7,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 
 *Severity*: medium
 
@@ -33,7 +33,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
index 2832cb2e32..4429fd7815 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-desktopimgdownldr-utility.asciidoc
@@ -8,7 +8,7 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies the desktopimgdownldr utility being used to download a remote file. A
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
index 4659b140f1..3354c45a7e 100644
--- a/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remote-file-download-via-mpcmdrun.asciidoc
@@ -8,7 +8,7 @@ Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
index bf577bf4b8..65570e6dc3 100644
--- a/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/remotely-started-services-via-rpc.asciidoc
@@ -1,7 +1,7 @@
 [[remotely-started-services-via-rpc]]
 === Remotely Started Services via RPC
 
-Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators."
+Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators.
 
 *Rule type*: eql
 
@@ -35,7 +35,7 @@ Identifies remote execution of Windows services over remote procedure call (RPC)
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
index af4fc217b9..9bceb6b00c 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-autoit-scripts-interpreter.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies a suspicious AutoIt process execution. Malware written as an AutoIt s
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
index c77948dd22..415108beb9 100644
--- a/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/renamed-utility-executed-with-short-program-name.asciidoc
@@ -8,7 +8,7 @@ Identifies the execution of a process with a single character process name, diff
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -35,7 +35,7 @@ Identifies the execution of a process with a single character process name, diff
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
index 830ce80931..7ef463e8a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/scheduled-tasks-at-command-enabled.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to enable the Windows scheduled tasks AT command via the reg
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies attempts to enable the Windows scheduled tasks AT command via the reg
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
new file mode 100644
index 0000000000..87e5293231
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/screenconnect-server-spawning-suspicious-processes.asciidoc
@@ -0,0 +1,87 @@
+[[screenconnect-server-spawning-suspicious-processes]]
+=== ScreenConnect Server Spawning Suspicious Processes
+
+Identifies suspicious processes being spawned by the ScreenConnect server process (ScreenConnect.Service.exe). This activity may indicate exploitation activity or access to an existing web shell backdoor.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* logs-system.security*
+* endgame-*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Tactic: Execution
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name : "ScreenConnect.Service.exe" and
+  (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe", "powershell_ise.exe", "csc.exe") or
+  ?process.pe.original_file_name in ("cmd.exe", "powershell.exe", "pwsh.dll", "powershell_ise.exe"))
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
index 5a63e59703..ec4e36b1ce 100644
--- a/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/searching-for-saved-credentials-via-vaultcmd.asciidoc
@@ -8,7 +8,7 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Windows Credential Manager allows you to create, view, or delete saved credentia
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
index 3aaa875a7e..03d1e25e2c 100644
--- a/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/service-control-spawned-via-script-interpreter.asciidoc
@@ -7,7 +7,7 @@ Identifies Service Control (sc.exe) spawning from script interpreter processes t
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-system.*
 * winlogbeat-*
 * logs-windows.*
@@ -37,7 +37,7 @@ Identifies Service Control (sc.exe) spawning from script interpreter processes t
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
index bc8618fbaf..dfaae66b25 100644
--- a/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sharepoint-malware-file-upload.asciidoc
@@ -30,7 +30,7 @@ Identifies the occurence of files uploaded to SharePoint being detected as Malwa
 * Data Source: Microsoft 365
 * Tactic: Lateral Movement
 
-*Version*: 105
+*Version*: 206
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
index 05b60ba654..505ec1f878 100644
--- a/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sip-provider-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies modifications to the registered Subject Interface Package (SIP) provi
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -35,7 +35,7 @@ Identifies modifications to the registered Subject Interface Package (SIP) provi
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
index fcaf2d9c60..5ae40204cc 100644
--- a/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/solarwinds-process-disabling-services-via-registry.asciidoc
@@ -8,7 +8,7 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies a SolarWinds binary modifying the start type of a service to be disab
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
index bdbb9589db..c95f526618 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-or-run-key-registry-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 
 *Severity*: low
 
@@ -31,7 +31,7 @@ Identifies run key or startup key registry modifications. In order to survive re
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
index 5ec6ad4a37..260c3e51ad 100644
--- a/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/startup-persistence-by-a-suspicious-process.asciidoc
@@ -8,7 +8,7 @@ Identifies files written to or modified in the startup folder by commonly abused
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies files written to or modified in the startup folder by commonly abused
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
index dc3fcd36b0..2be7b0aeba 100644
--- a/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/sunburst-command-and-control-activity.asciidoc
@@ -7,7 +7,7 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.network-*
 
 *Severity*: high
 
@@ -32,7 +32,7 @@ The malware known as SUNBURST targets the SolarWind's Orion business software fo
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
new file mode 100644
index 0000000000..411579ec5d
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-access-to-ldap-attributes.asciidoc
@@ -0,0 +1,81 @@
+[[suspicious-access-to-ldap-attributes]]
+=== Suspicious Access to LDAP Attributes
+
+Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* winlogbeat-*
+* logs-system.security*
+* logs-windows.forwarded*
+
+*Severity*: high
+
+*Risk score*: 73
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: None
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Discovery
+* Data Source: System
+* Data Source: Active Directory
+* Data Source: Windows
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Setup
+
+
+The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+Computer Configuration >
+Policies >
+Windows Settings >
+Security Settings >
+Advanced Audit Policies Configuration >
+Audit Policies >
+DS Access >
+Audit Directory Service Changes (Success,Failure)
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+any where event.action == "Directory Service Access" and
+ event.code == "4662" and not winlog.event_data.SubjectUserSid : "S-1-5-18" and
+ winlog.event_data.AccessMaskDescription == "Read Property" and length(winlog.event_data.Properties) >= 2000
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Discovery
+** ID: TA0007
+** Reference URL: https://attack.mitre.org/tactics/TA0007/
+* Technique:
+** Name: Permission Groups Discovery
+** ID: T1069
+** Reference URL: https://attack.mitre.org/techniques/T1069/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
index 102da97ae2..98bfa9736c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-antimalware-scan-interface-dll.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusu
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 8
+*Version*: 9
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
index 259ececba6..5e0d0bac67 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-certutil-commands.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -40,7 +40,7 @@ Identifies suspicious commands being used with certutil.exe. CertUtil is a nativ
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
index b7cde92825..9d2f73d1a7 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-cmd-execution-via-wmi.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious command execution (cmd) via Windows Management Instrumenta
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -34,7 +34,7 @@ Identifies suspicious command execution (cmd) via Windows Management Instrumenta
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
index 71048822da..5b21ca60dc 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-dll-loaded-for-persistence-or-privilege-escalation.asciidoc
@@ -8,7 +8,7 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.library*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -44,7 +44,7 @@ Identifies the loading of a non Microsoft signed DLL that is missing on a defaul
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
index 14c244dcd4..4e48e658f3 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-endpoint-security-parent-process.asciidoc
@@ -8,7 +8,7 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ A suspicious Endpoint Security parent process was detected. This may indicate a
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
index a537aec2e8..2b1cacd613 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-a-mounted-device.asciidoc
@@ -8,7 +8,7 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: medium
@@ -36,7 +36,7 @@ Identifies when a script interpreter or signed binary is launched via a non-stan
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
index f9b05f668a..ee70a2e2f2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-from-inet-cache.asciidoc
@@ -8,7 +8,7 @@ Identifies the execution of a process with arguments pointing to the INetCache F
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies the execution of a process with arguments pointing to the INetCache F
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
index 6422a512da..8241e56d79 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-microsoft-office-add-ins.asciidoc
@@ -8,7 +8,7 @@ Identifies execution of common Microsoft Office applications to launch an Office
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies execution of common Microsoft Office applications to launch an Office
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 4
+*Version*: 5
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
index 72435ecfd4..bacf2ddaba 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-scheduled-task.asciidoc
@@ -8,7 +8,7 @@ Identifies execution of a suspicious program via scheduled tasks by looking at p
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 
 *Severity*: medium
@@ -32,7 +32,7 @@ Identifies execution of a suspicious program via scheduled tasks by looking at p
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
index ce3da7b301..00d005d52b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-execution-via-windows-subsystem-for-linux.asciidoc
@@ -8,7 +8,7 @@ Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversarie
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -39,7 +39,7 @@ Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversarie
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
index 7acc259614..b0a47b1feb 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-explorer-child-process.asciidoc
@@ -7,7 +7,7 @@ Identifies a suspicious Windows explorer child process. Explorer.exe can be abus
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies a suspicious Windows explorer child process. Explorer.exe can be abus
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
index f69c1ad2a8..3b2e5dc397 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-image-load-taskschd-dll-from-ms-office.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious image load (taskschd.dll) from Microsoft Office processe
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies a suspicious image load (taskschd.dll) from Microsoft Office processe
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
index c743c89e8b..d1d7c02b29 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-imagepath-service-creation.asciidoc
@@ -7,7 +7,7 @@ Identifies the creation of a suspicious ImagePath value. This could be an indica
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -34,7 +34,7 @@ Identifies the creation of a suspicious ImagePath value. This could be an indica
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
index 0c67444aba..629d7ff1a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-inter-process-communication-via-outlook.asciidoc
@@ -7,7 +7,7 @@ Detects Inter-Process Communication with Outlook via Component Object Model from
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process*
 
 *Severity*: medium
 
@@ -31,7 +31,7 @@ Detects Inter-Process Communication with Outlook via Component Object Model from
 * Tactic: Collection
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc
new file mode 100644
index 0000000000..4f8cbf744c
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-jetbrains-teamcity-child-process.asciidoc
@@ -0,0 +1,98 @@
+[[suspicious-jetbrains-teamcity-child-process]]
+=== Suspicious JetBrains TeamCity Child Process
+
+Identifies suspicious processes being spawned by the JetBrain TeamCity process. This activity could be related to JetBrains remote code execution vulnerabilities.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.*
+* endgame-*
+* logs-system.security*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.trendmicro.com/en_us/research/24/c/teamcity-vulnerability-exploits-lead-to-jasmin-ransomware.html
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Initial Access
+* Data Source: Elastic Endgame
+* Use Case: Vulnerability
+* Data Source: Elastic Defend
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.executable :
+                 ("?:\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\Program Files\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\Program Files (x86)\\TeamCity\\jre\\bin\\java.exe",
+                  "?:\\TeamCity\\BuildAgent\\jre\\bin\\java.exe") and
+  process.name : ("cmd.exe", "powershell.exe", "msiexec.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe", "curl.exe", "ssh.exe",
+                   "rundll32.exe", "regsvr32.exe", "mshta.exe", "certreq.exe", "net.exe", "nltest.exe", "whoami.exe", "hostname.exe",
+                   "tasklist.exe", "arp.exe", "nbtstat.exe", "netstat.exe", "reg.exe", "tasklist.exe", "Microsoft.Workflow.Compiler.exe",
+                   "arp.exe", "atbroker.exe", "bginfo.exe", "bitsadmin.exe", "cdb.exe", "cmstp.exe", "control.exe", "cscript.exe", "csi.exe",
+                   "dnx.exe", "dsget.exe", "dsquery.exe", "forfiles.exe", "fsi.exe", "ftp.exe", "gpresult.exe", "ieexec.exe", "iexpress.exe",
+                   "installutil.exe", "ipconfig.exe","msxsl.exe", "netsh.exe", "odbcconf.exe", "ping.exe", "pwsh.exe", "qprocess.exe",
+                   "quser.exe", "qwinsta.exe", "rcsi.exe", "regasm.exe", "regsvcs.exe", "regsvr32.exe", "sc.exe", "schtasks.exe",
+                   "systeminfo.exe", "tracert.exe", "wmic.exe", "wscript.exe","xwizard.exe", "explorer.exe", "msdt.exe") and
+ not (process.name : "powershell.exe" and process.args : "-ExecutionPolicy" and process.args : "?:\\TeamCity\\buildAgent\\work\\*.ps1") and
+ not (process.name : "cmd.exe" and process.args : "dir" and process.args : "/-c")
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Initial Access
+** ID: TA0001
+** Reference URL: https://attack.mitre.org/tactics/TA0001/
+* Technique:
+** Name: Exploit Public-Facing Application
+** ID: T1190
+** Reference URL: https://attack.mitre.org/techniques/T1190/
+* Tactic:
+** Name: Execution
+** ID: TA0002
+** Reference URL: https://attack.mitre.org/tactics/TA0002/
+* Technique:
+** Name: Command and Scripting Interpreter
+** ID: T1059
+** Reference URL: https://attack.mitre.org/techniques/T1059/
+* Sub-technique:
+** Name: PowerShell
+** ID: T1059.001
+** Reference URL: https://attack.mitre.org/techniques/T1059/001/
+* Sub-technique:
+** Name: Windows Command Shell
+** ID: T1059.003
+** Reference URL: https://attack.mitre.org/techniques/T1059/003/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
index 6f58622dda..6338c69f63 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-365-mail-access-by-clientappid.asciidoc
@@ -31,7 +31,7 @@ Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was ob
 * Use Case: Configuration Audit
 * Tactic: Initial Access
 
-*Version*: 4
+*Version*: 105
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
index beaddc0515..b8c45959fe 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-microsoft-diagnostics-wizard-execution.asciidoc
@@ -7,7 +7,7 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
index 3b7dac2d82..8cbf34f688 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-module-loaded-by-lsass.asciidoc
@@ -7,7 +7,7 @@ Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -32,7 +32,7 @@ Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
index dfe5f6e9a6..4445b310d8 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-office-child-process.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -39,7 +39,7 @@ Identifies suspicious child processes of frequently targeted Microsoft Office ap
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
index e32d7dc0ff..a3400b7a8b 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-ms-outlook-child-process.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies suspicious child processes of Microsoft Outlook. These child processe
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
index 8325355f27..c950fcbffc 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-code-compilation.asciidoc
@@ -8,7 +8,7 @@ Identifies executions of .NET compilers with suspicious parent processes, which
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies executions of .NET compilers with suspicious parent processes, which
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
index 37aad4e9eb..2ed0bf8046 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-net-reflection-via-powershell.asciidoc
@@ -34,7 +34,7 @@ Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerSh
 * Resources: Investigation Guide
 * Data Source: PowerShell Logs
 
-*Version*: 112
+*Version*: 212
 
 *Rule authors*: 
 
@@ -160,7 +160,6 @@ event.category:process and host.os.type:windows and
         ("Get-SolutionFiles" or "Get-VisualStudio" or "Select-MSBuildPath") and
         file.name : "PathFunctions.ps1"
   ) and
-  not file.path : C\:\\\\Program?Files\\\\Microsoft?Monitoring?Agent\\\\Agent\\\\Health?Service?State\\\\Monitoring?Host?Temporary?Files*\\\\AvailabilityGroupMonitoring.ps1 and
   not user.id : "S-1-5-18"
 
 ----------------------------------
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
index 3d87dc7271..8c73d91d12 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-pdf-reader-child-process.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious child processes of PDF reader applications. These child pr
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies suspicious child processes of PDF reader applications. These child pr
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
index bee8ba8624..6002abc7c6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-powershell-engine-imageload.asciidoc
@@ -7,7 +7,7 @@ Identifies the PowerShell engine being invoked by unexpected processes. Rather t
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -30,7 +30,7 @@ Identifies the PowerShell engine being invoked by unexpected processes. Rather t
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 209
+*Version*: 210
 
 *Rule authors*: 
 
@@ -107,15 +107,15 @@ host.os.type:windows and event.category:library and
     process.code_signature.subject_name:("Microsoft Corporation" or "Microsoft Dynamic Code Publisher" or "Microsoft Windows") and process.code_signature.trusted:true and not process.name.caseless:("regsvr32.exe" or "rundll32.exe")
   ) and 
   not (
-    process.executable.caseless:(?\:\\\\Program?Files?\(x86\)\\\\*.exe or ?\:\\\\Program?Files\\\\*.exe) and
+    process.executable.caseless:(C\:\\Program*Files*\(x86\)\\*.exe or C\:\\Program*Files\\*.exe) and
     process.code_signature.trusted:true
   ) and 
   not (
-    process.executable.caseless:?\:\\\\Windows\\\\Lenovo\\\\*.exe and process.code_signature.subject_name:"Lenovo" and 
+    process.executable.caseless: C\:\\Windows\\Lenovo\\*.exe and process.code_signature.subject_name:"Lenovo" and 
     process.code_signature.trusted:true
   ) and 
   not (
-    process.executable.caseless:?\:\\\\ProgramData\\\\chocolatey\\\\choco.exe* and
+    process.executable.caseless: "C:\\ProgramData\\chocolatey\\choco.exe" and
     process.code_signature.subject_name:"Chocolatey Software, Inc." and process.code_signature.trusted:true
   ) and not process.executable.caseless : "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
index 175ca2e1cd..f464e74a3c 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-file-deletion.asciidoc
@@ -8,7 +8,7 @@ Detects deletion of print driver files by an unusual process. This may indicate
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -37,7 +37,7 @@ Detects deletion of print driver files by an unusual process. This may indicate
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
index 99f9ccfce9..4f031b53ae 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-point-and-print-dll.asciidoc
@@ -7,7 +7,7 @@ Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030)
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -38,7 +38,7 @@ Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030)
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 105
+*Version*: 106
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
index 0738e93174..19ba68b588 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-print-spooler-spl-file-created.asciidoc
@@ -7,7 +7,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * endgame-*
 
 *Severity*: medium
@@ -35,7 +35,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
index 5ee67d7eee..b5f2fa085f 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-printspooler-service-executable-file-creation.asciidoc
@@ -8,7 +8,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Detects attempts to exploit privilege escalation vulnerabilities related to the
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
index 8ec4a851b4..12dfb1b615 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-process-execution-via-renamed-psexec-executable.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious psexec activity which is executing from the psexec service
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies suspicious psexec activity which is executing from the psexec service
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
index 5fb15c20d2..924fecd808 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-rdp-activex-client-loaded.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Clien
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -36,7 +36,7 @@ Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Clien
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc
new file mode 100644
index 0000000000..9672f8383f
--- /dev/null
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-screenconnect-client-child-process.asciidoc
@@ -0,0 +1,86 @@
+[[suspicious-screenconnect-client-child-process]]
+=== Suspicious ScreenConnect Client Child Process
+
+Identifies suspicious processes being spawned by the ScreenConnect client processes. This activity may indicate execution abusing unauthorized access to the ScreenConnect remote access software.
+
+*Rule type*: eql
+
+*Rule indices*: 
+
+* logs-endpoint.events.process-*
+* winlogbeat-*
+* logs-windows.sysmon_operational-*
+* logs-system.security*
+* endgame-*
+
+*Severity*: medium
+
+*Risk score*: 47
+
+*Runs every*: 5m
+
+*Searches indices from*: now-9m ({ref}/common-options.html#date-math[Date Math format], see also <<rule-schedule, `Additional look-back time`>>)
+
+*Maximum alerts per execution*: 100
+
+*References*: 
+
+* https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
+
+*Tags*: 
+
+* Domain: Endpoint
+* OS: Windows
+* Use Case: Threat Detection
+* Tactic: Command and Control
+* Resources: Investigation Guide
+* Data Source: Elastic Endgame
+* Data Source: Elastic Defend
+* Data Source: Sysmon
+
+*Version*: 1
+
+*Rule authors*: 
+
+* Elastic
+
+*Rule license*: Elastic License v2
+
+
+==== Rule query
+
+
+[source, js]
+----------------------------------
+process where host.os.type == "windows" and event.type == "start" and
+  process.parent.name :
+                ("ScreenConnect.ClientService.exe",
+                 "ScreenConnect.WindowsClient.exe",
+                 "ScreenConnect.WindowsBackstageShell.exe",
+                 "ScreenConnect.WindowsFileManager.exe") and
+  (
+   (process.name : "powershell.exe" and
+    process.args : ("-enc", "-ec", "-e", "*downloadstring*", "*Reflection.Assembly*", "*http*")) or
+   (process.name : "cmd.exe" and process.args : "/c") or
+   (process.name : "net.exe" and process.args : "/add") or
+   (process.name : "schtasks.exe" and process.args : ("/create", "-create")) or
+   (process.name : "sc.exe" and process.args : "create") or
+   (process.name : "rundll32.exe" and not process.args : "url.dll,FileProtocolHandler") or
+   (process.name : "msiexec.exe" and process.args : ("/i", "-i") and
+    process.args : ("/q", "/quiet", "/qn", "-q", "-quiet", "-qn", "-Q+")) or
+   process.name : ("mshta.exe", "certutil.exe", "bistadmin.exe", "certreq.exe", "wscript.exe", "cscript.exe", "curl.exe", 
+                   "ssh.exe", "scp.exe", "wevtutil.exe", "wget.exe", "wmic.exe")
+   )
+
+----------------------------------
+
+*Framework*: MITRE ATT&CK^TM^
+
+* Tactic:
+** Name: Command and Control
+** ID: TA0011
+** Reference URL: https://attack.mitre.org/tactics/TA0011/
+* Technique:
+** Name: Remote Access Software
+** ID: T1219
+** Reference URL: https://attack.mitre.org/techniques/T1219/
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
index df6177ab42..b050a7d5fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-solarwinds-child-process.asciidoc
@@ -7,7 +7,7 @@ A suspicious SolarWinds child process was detected, which may indicate an attemp
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * endgame-*
 
 *Severity*: medium
@@ -34,7 +34,7 @@ A suspicious SolarWinds child process was detected, which may indicate an attemp
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
index d89e89d0a0..da4c2dd6a9 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-startup-shell-folder-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -35,7 +35,7 @@ Identifies suspicious startup shell folder modifications to change the default S
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
index c96ef5600f..fab2e0ddc2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc
@@ -8,7 +8,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 
@@ -40,7 +40,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
index b1183b9c2e..0db42c7da2 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-host.asciidoc
@@ -30,7 +30,7 @@ A machine learning job combination has detected a set of one or more suspicious
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -72,9 +72,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -105,10 +105,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
index 7a30296604..13bbf33559 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-parent-process.asciidoc
@@ -32,7 +32,7 @@ A machine learning job combination has detected a set of one or more suspicious
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -74,9 +74,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -107,10 +107,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
index e229643f45..1bf58264d6 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-windows-process-cluster-spawned-by-a-user.asciidoc
@@ -32,7 +32,7 @@ A machine learning job combination has detected a set of one or more suspicious
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -74,9 +74,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -107,10 +107,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
index 0e1770f5e4..33343fce67 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-wmi-image-load-from-ms-office.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processe
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processe
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
index 299e8ec39a..a845f6af75 100644
--- a/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/suspicious-zoom-child-process.asciidoc
@@ -8,7 +8,7 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ A suspicious Zoom child process was detected, which may indicate an attempt to r
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
index 82f1c21cbc..98c3a73bfe 100644
--- a/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/svchost-spawning-cmd.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * logs-system.security*
 
@@ -35,7 +35,7 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 210
+*Version*: 211
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
index 984523bd3d..766e8f39b4 100644
--- a/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/symbolic-link-to-shadow-copy-created.asciidoc
@@ -8,7 +8,7 @@ Identifies the creation of symbolic links to a shadow copy. Symbolic links can b
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -40,7 +40,7 @@ Identifies the creation of symbolic links to a shadow copy. Symbolic links can b
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
index ceeea7cccb..79f8947f3c 100644
--- a/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/system-shells-via-services.asciidoc
@@ -8,7 +8,7 @@ Windows services typically run as SYSTEM and can be used as a privilege escalati
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Windows services typically run as SYSTEM and can be used as a privilege escalati
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
index 527da49f26..2c61e00cf4 100644
--- a/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/third-party-backup-files-deleted-via-unexpected-process.asciidoc
@@ -7,7 +7,7 @@ Identifies the deletion of backup files, saved using third-party software, by a
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * endgame-*
 
 *Severity*: medium
@@ -34,7 +34,7 @@ Identifies the deletion of backup files, saved using third-party software, by a
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
index 7a948add8a..8abadaf46e 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-elevated-com-internet-explorer-add-on-installer.asciidoc
@@ -8,7 +8,7 @@ Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
index ef6ff4c0b0..d3bd8813c1 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-privileged-ifileoperation-com-interface.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. A
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. A
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
index 5b0b796ff8..78e817415f 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-via-windows-directory-masquerading.asciidoc
@@ -8,7 +8,7 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies an attempt to bypass User Account Control (UAC) by masquerading as a
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 111
+*Version*: 112
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
index f1da8de20f..b14e3ec173 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-attempt-with-ieditionupgrademanager-elevated-com-interface.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to bypass User Account Control (UAC) by abusing an elevated
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies attempts to bypass User Account Control (UAC) by abusing an elevated
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
index 29bafa261e..4c6850a1f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-diskcleanup-scheduled-task-hijack.asciidoc
@@ -8,7 +8,7 @@ Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
index 2d6519605f..b4aa4f6f1b 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-icmluautil-elevated-com-interface.asciidoc
@@ -8,7 +8,7 @@ Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevate
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevate
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
index e80c3212c7..eef22f61fd 100644
--- a/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uac-bypass-via-windows-firewall-snap-in-hijack.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to bypass User Account Control (UAC) by hijacking the Micros
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -38,7 +38,7 @@ Identifies attempts to bypass User Account Control (UAC) by hijacking the Micros
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc b/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
index bc64c43fb8..6591ffc040 100644
--- a/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/uncommon-registry-persistence-change.asciidoc
@@ -7,7 +7,7 @@ Detects changes to registry persistence keys that are not commonly used or modif
 
 *Rule indices*: 
 
-* logs-endpoint.events.registry*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: medium
@@ -33,7 +33,7 @@ Detects changes to registry persistence keys that are not commonly used or modif
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 106
+*Version*: 107
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
index 6985df5791..591b2665b3 100644
--- a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-loaded-by-svchost.asciidoc
@@ -7,7 +7,7 @@ Identifies an unsigned library created in the last 5 minutes and subsequently lo
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -31,7 +31,7 @@ Identifies an unsigned library created in the last 5 minutes and subsequently lo
 * Tactic: Execution
 * Data Source: Elastic Defend
 
-*Version*: 5
+*Version*: 6
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
index e67a8f013f..269d37ee04 100644
--- a/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unsigned-dll-side-loading-from-a-suspicious-folder.asciidoc
@@ -7,7 +7,7 @@ Identifies a Windows trusted program running from locations often abused by adve
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -29,7 +29,7 @@ Identifies a Windows trusted program running from locations often abused by adve
 * Tactic: Defense Evasion
 * Data Source: Elastic Defend
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
index 8b8a79764f..74a1cd21c0 100644
--- a/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/untrusted-driver-loaded.asciidoc
@@ -7,7 +7,7 @@ Identifies attempt to load an untrusted driver. Adversaries may modify code sign
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.library-*
 
 *Severity*: high
 
@@ -33,7 +33,7 @@ Identifies attempt to load an untrusted driver. Adversaries may modify code sign
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
index 98ec485349..58aedf5c5c 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-from-a-system-virtual-process.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -34,7 +34,7 @@ Identifies a suspicious child process of the Windows virtual system process, whi
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
index 720f6cb6fc..e7d2aaa57a 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-process-of-dns-exe.asciidoc
@@ -8,7 +8,7 @@ Identifies an unexpected process spawning from dns.exe, the process responsible
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -41,7 +41,7 @@ Identifies an unexpected process spawning from dns.exe, the process responsible
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
index 3cddbdb57d..5e98078ca6 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-child-processes-of-rundll32.asciidoc
@@ -7,7 +7,7 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 
@@ -32,7 +32,7 @@ Identifies child processes of unusual instances of RunDLL32 where the command li
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
index acc4e18a7a..52dadf20b8 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-executable-file-creation-by-a-system-critical-process.asciidoc
@@ -8,7 +8,7 @@ Identifies an unexpected executable file being created or modified by a Windows
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies an unexpected executable file being created or modified by a Windows
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
index 10e019235c..119e9c3bf8 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-creation-alternate-data-stream.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious creation of Alternate Data Streams on highly targeted file
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 
 *Severity*: medium
@@ -33,7 +33,7 @@ Identifies suspicious creation of Alternate Data Streams on highly targeted file
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 113
+*Version*: 114
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
index 2cba718f14..0ebd7fa287 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-file-modification-by-dns-exe.asciidoc
@@ -8,7 +8,7 @@ Identifies an unexpected file being modified by dns.exe, the process responsible
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -39,7 +39,7 @@ Identifies an unexpected file being modified by dns.exe, the process responsible
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
index 0292879cb4..f69da0770f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-child-relationship.asciidoc
@@ -8,7 +8,7 @@ Identifies Windows programs run from unexpected parent processes. This could ind
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -38,7 +38,7 @@ Identifies Windows programs run from unexpected parent processes. This could ind
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
index 8e376f13e5..5e236d32b9 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-parent-process-for-cmd-exe.asciidoc
@@ -8,7 +8,7 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -34,7 +34,7 @@ Identifies a suspicious parent child process relationship with cmd.exe descendin
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
index 8d133aff57..bf71943d64 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-persistence-via-services-registry.asciidoc
@@ -7,7 +7,7 @@ Identifies processes modifying the services registry key directly, instead of th
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -34,7 +34,7 @@ Identifies processes modifying the services registry key directly, instead of th
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
index bdbbbcb64c..876bfa3c45 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-print-spooler-child-process.asciidoc
@@ -8,7 +8,7 @@ Detects unusual Print Spooler service (spoolsv.exe) child processes. This may in
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * logs-system.security*
 
@@ -35,7 +35,7 @@ Detects unusual Print Spooler service (spoolsv.exe) child processes. This may in
 * Use Case: Vulnerability
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
index 9bcf8f6f3f..651dd85e16 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-execution-path-alternate-data-stream.asciidoc
@@ -7,7 +7,7 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -34,7 +34,7 @@ Identifies processes running from an Alternate Data Stream. This is uncommon for
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
index 93f970f352..9cf101a7bb 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-host.asciidoc
@@ -32,7 +32,7 @@ A machine learning job has detected a suspicious Windows process. This process h
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -74,9 +74,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -107,10 +107,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: If the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and check whether any ProblemChild predictions have been generated.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
index 023caee207..f1e30e1027 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-parent-process.asciidoc
@@ -32,7 +32,7 @@ A machine learning job has detected a suspicious Windows process. This process h
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -74,9 +74,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -107,10 +107,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
index e0a7da91de..fceae7405f 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-process-spawned-by-a-user.asciidoc
@@ -32,7 +32,7 @@ A machine learning job has detected a suspicious Windows process. This process h
 * Rule Type: Machine Learning
 * Tactic: Defense Evasion
 
-*Version*: 3
+*Version*: 4
 
 *Rule authors*: 
 
@@ -74,9 +74,9 @@ The LotL Attack Detection integration detects living-off-the-land activity in Wi
 
 *Ingest Pipeline Setup*
 
-Before you can enable this rule, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
+**Before you can enable this rule**, you'll need to enrich Windows process events with predictions from the Supervised LotL Attack Detection model. This is done via the ingest pipeline named `<package_version>-problem_child_ingest_pipeline` installed with the LotL Attack Detection package.
 - If using an Elastic Beat such as Winlogbeat, add the LotL ingest pipeline to it by adding a simple configuration https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#pipelines-for-beats[setting] to `winlogbeat.yml`.
-- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor].
+- If adding the LotL ingest pipeline to an existing pipeline, use a https://www.elastic.co/guide/en/elasticsearch/reference/current/pipeline-processor.html[pipeline processor]. For example, you can check if your winlogbeat or Elastic Defend (the https://docs.elastic.co/en/integrations/endpoint#logs[default index pattern] being `logs-endpoint*`) already has an ingest pipeline by navigating to `Data > Index Management`, finding the index (sometimes you need to toggle "Include hidden indices"), and checking the index's settings for a default or final https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html#set-default-pipeline[pipeline].
 
 
 *Adding Custom Mappings*
@@ -107,10 +107,10 @@ Before you can enable this rule, you'll need to enrich Windows process events wi
 
 *Anomaly Detection Setup*
 
-Before you can enable this rule, you'll need to enable the corresponding Anomaly Detection job. 
+**Before you can enable this rule**, you'll need to enable the corresponding Anomaly Detection job. 
 - Go to the Kibana homepage. Under Analytics, click Machine Learning.
 - Under Anomaly Detection, click Jobs, and then click "Create job". Select the Data View containing your enriched Windows process events. For example, this would be `logs-endpoint.events.*` if you used Elastic Defend to collect events, or `winlogbeat-*` if you used Winlogbeat.
-- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs".
+- If the selected Data View contains events that match the query in https://github.com/elastic/integrations/blob/main/packages/problemchild/kibana/ml_module/problemchild-ml.json[this] configuration file, you will see a card for "Living off the Land Attack Detection" under "Use preconfigured jobs". Warning: if the ingest pipeline hasn't run for some reason, such as no eligible data in winlogbeat has come in yet, _you won't be able to see this card yet_. If that is the case, try troubleshooting the ingest pipeline, and if any ProblemChild predictions have been populated yet.
 - Keep the default settings and click "Create jobs" to start the anomaly detection job and datafeed.
 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
index 163784b791..cc64c51259 100644
--- a/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/unusual-service-host-child-process-childless-service.asciidoc
@@ -7,7 +7,7 @@ Identifies unusual child processes of Service Host (svchost.exe) that traditiona
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.sysmon_operational-*
 * endgame-*
@@ -35,7 +35,7 @@ Identifies unusual child processes of Service Host (svchost.exe) that traditiona
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
index 7d5e8f501d..ef8cb552a4 100644
--- a/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/user-account-creation.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to create new users. This is sometimes done by attackers to
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies attempts to create new users. This is sometimes done by attackers to
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 108
+*Version*: 109
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/veeam-backup-library-loaded-by-unusual-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/veeam-backup-library-loaded-by-unusual-process.asciidoc
index febf104068..5950e6927d 100644
--- a/docs/detections/prebuilt-rules/rule-details/veeam-backup-library-loaded-by-unusual-process.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/veeam-backup-library-loaded-by-unusual-process.asciidoc
@@ -7,7 +7,7 @@ Identifies potential credential decrypt operations by PowerShell or unsigned pro
 
 *Rule indices*: 
 
-* logs-endpoint.events.library*
+* logs-endpoint.events.library-*
 
 *Severity*: medium
 
@@ -29,7 +29,7 @@ Identifies potential credential decrypt operations by PowerShell or unsigned pro
 * Tactic: Credential Access
 * Data Source: Elastic Defend
 
-*Version*: 1
+*Version*: 2
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
index 17a4bd7ee8..b39522eee7 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deleted-or-resized-via-vssadmin.asciidoc
@@ -8,7 +8,7 @@ Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -35,7 +35,7 @@ Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
index 99193edbbd..22eccfa8bb 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-powershell.asciidoc
@@ -8,7 +8,7 @@ Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -40,7 +40,7 @@ Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
index f8b68d2c5d..163a1654cb 100644
--- a/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/volume-shadow-copy-deletion-via-wmic.asciidoc
@@ -8,7 +8,7 @@ Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
index e135acf8a1..d600c233e3 100644
--- a/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/web-shell-detection-script-process-child-of-common-web-processes.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -41,7 +41,7 @@ Identifies suspicious commands executed via a web server, which may suggest a vu
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
index e3d491e4d9..260415adaf 100644
--- a/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/whoami-process-activity.asciidoc
@@ -8,7 +8,7 @@ Identifies suspicious use of whoami.exe which displays user, group, and privileg
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * logs-system.*
 * endgame-*
@@ -35,7 +35,7 @@ Identifies suspicious use of whoami.exe which displays user, group, and privileg
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
index bb6af69178..708a69a255 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-disabled-via-registry-modification.asciidoc
@@ -7,7 +7,7 @@ Identifies modifications to the Windows Defender registry settings to disable th
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * endgame-*
 * logs-windows.sysmon_operational-*
 
@@ -36,7 +36,7 @@ Identifies modifications to the Windows Defender registry settings to disable th
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
index c361fbd4f6..37c95a42e4 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-defender-exclusions-added-via-powershell.asciidoc
@@ -8,7 +8,7 @@ Identifies modifications to the Windows Defender configuration settings using Po
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -37,7 +37,7 @@ Identifies modifications to the Windows Defender configuration settings using Po
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
index 2216b523f2..5bd3dd5dd8 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-firewall-disabled-via-powershell.asciidoc
@@ -7,7 +7,7 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * winlogbeat-*
 * logs-windows.*
 * endgame-*
@@ -40,7 +40,7 @@ Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 109
+*Version*: 110
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
index 67400d93af..2126f03f09 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-registry-file-creation-in-smb-share.asciidoc
@@ -7,7 +7,7 @@ Identifies the creation or modification of a medium-size registry hive file on a
 
 *Rule indices*: 
 
-* logs-endpoint.events.*
+* logs-endpoint.events.file-*
 
 *Severity*: medium
 
@@ -33,7 +33,7 @@ Identifies the creation or modification of a medium-size registry hive file on a
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 107
+*Version*: 108
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
index c0d6195ea4..7714343a61 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-script-executing-powershell.asciidoc
@@ -8,7 +8,7 @@ Identifies a PowerShell process launched by either cscript.exe or wscript.exe. O
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Identifies a PowerShell process launched by either cscript.exe or wscript.exe. O
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 110
+*Version*: 111
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
index 41a36f31cd..e0e1147a9a 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-distribution-installed.asciidoc
@@ -8,7 +8,7 @@ Detects changes to the registry that indicates the install of a new Windows Subs
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.registry-*
 * logs-windows.sysmon_operational-*
 * endgame-*
 
@@ -36,7 +36,7 @@ Detects changes to the registry that indicates the install of a new Windows Subs
 * Data Source: Elastic Defend
 * Data Source: Sysmon
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
index 300ebef06e..46cd1c47f6 100644
--- a/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/windows-subsystem-for-linux-enabled-via-dism-utility.asciidoc
@@ -8,7 +8,7 @@ Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -36,7 +36,7 @@ Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism
 * Data Source: Elastic Endgame
 * Data Source: Elastic Defend
 
-*Version*: 6
+*Version*: 7
 
 *Rule authors*: 
 
diff --git a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
index e73bf1593e..edc82f3bc4 100644
--- a/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
+++ b/docs/detections/prebuilt-rules/rule-details/wireless-credential-dumping-using-netsh-command.asciidoc
@@ -8,7 +8,7 @@ Identifies attempts to dump Wireless saved access keys in clear text using the W
 *Rule indices*: 
 
 * winlogbeat-*
-* logs-endpoint.events.*
+* logs-endpoint.events.process-*
 * logs-windows.*
 * endgame-*
 * logs-system.security*
@@ -39,7 +39,7 @@ Identifies attempts to dump Wireless saved access keys in clear text using the W
 * Resources: Investigation Guide
 * Data Source: Elastic Defend
 
-*Version*: 7
+*Version*: 8
 
 *Rule authors*: 
 
diff --git a/docs/index.asciidoc b/docs/index.asciidoc
index c7fd5fdc18..4bf4300b82 100644
--- a/docs/index.asciidoc
+++ b/docs/index.asciidoc
@@ -99,3 +99,5 @@ include::detections/prebuilt-rules/downloadable-packages/8-12-5/prebuilt-rules-8
 include::detections/prebuilt-rules/downloadable-packages/8-12-6/prebuilt-rules-8-12-6-appendix.asciidoc[]
 
 include::detections/prebuilt-rules/downloadable-packages/8-12-7/prebuilt-rules-8-12-7-appendix.asciidoc[]
+
+include::detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc[]

From 0c110bf00aee500ba41f2f8316e93b1304c11c31 Mon Sep 17 00:00:00 2001
From: Shashank K S <Shashank.Suryanarayana@elastic.co>
Date: Wed, 3 Apr 2024 20:59:12 +0530
Subject: [PATCH 2/2] Update summary for 8.12.8

---
 .../8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc          | 1 -
 .../8-12-8/prebuilt-rules-8-12-8-summary.asciidoc           | 2 --
 .../prebuilt-rules-downloadable-updates.asciidoc            | 6 +++++-
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
index 8df579d4fa..8bf3490146 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-appendix.asciidoc
@@ -250,4 +250,3 @@ include::prebuilt-rule-8-12-8-unusual-print-spooler-child-process.asciidoc[]
 include::prebuilt-rule-8-12-8-unusual-service-host-child-process-childless-service.asciidoc[]
 include::prebuilt-rule-8-12-8-privileges-elevation-via-parent-process-pid-spoofing.asciidoc[]
 include::prebuilt-rule-8-12-8-process-created-with-an-elevated-token.asciidoc[]
-include::prebuilt-rule-8-12-8-deprecated-remote-file-creation-on-a-sensitive-directory.asciidoc[]
diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
index c3bfec82fb..5535d03fb2 100644
--- a/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
+++ b/docs/detections/prebuilt-rules/downloadable-packages/8-12-8/prebuilt-rules-8-12-8-summary.asciidoc
@@ -501,6 +501,4 @@ This section lists all updates associated with version 8.12.8 of the Fleet integ
 
 |<<prebuilt-rule-8-12-8-process-created-with-an-elevated-token, Process Created with an Elevated Token>> | Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls. | update | 6 
 
-|<<prebuilt-rule-8-12-8-deprecated-remote-file-creation-on-a-sensitive-directory, Deprecated - Remote File Creation on a Sensitive Directory>> | Discovery of files created by a remote host on sensitive directories and folders. Remote file creation in these directories could indicate a malicious binary or script trying to compromise the system. | deprecated | 3 
-
 |==============================================
diff --git a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
index fea83b0430..1adb1fe4c8 100644
--- a/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
+++ b/docs/detections/prebuilt-rules/prebuilt-rules-downloadable-updates.asciidoc
@@ -14,7 +14,11 @@ For previous rule updates, please navigate to the https://www.elastic.co/guide/e
 
 
 |<<prebuilt-rule-8-12-8-prebuilt-rules-8-12-8-summary, 8.12.8>> | 03 Apr 2024 | 8 | 238 | 
-Adding Release Notes to 8.12.8
+This release includes new rules for Linux and Windows and tuned rules for Windows.
+Deprecated rules include `Remote File Creation on a Sensitive Directory`
+New rules for Linux include detection for persistence.
+New rules for Windows include detection for credential access, initial access, discovery and command and control.
+Additionally, significant rule tuning for Windows rules has been added for better rule efficacy and performance.
 
 
 |<<prebuilt-rule-8-12-7-prebuilt-rules-8-12-7-summary, 8.12.7>> | 25 Mar 2024 | 5 | 549 |