From 6a28881b5fd578be3209766d925a78592e636919 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 9 Jul 2024 19:13:24 +0530 Subject: [PATCH] Lock versions for releases: 8.9,8.10,8.11,8.12,8.13,8.14 (#3880) --- detection_rules/etc/version.lock.json | 213 ++++++++++++++++++-------- 1 file changed, 146 insertions(+), 67 deletions(-) diff --git a/detection_rules/etc/version.lock.json b/detection_rules/etc/version.lock.json index 2a52e57ebb9..21c6d05d81e 100644 --- a/detection_rules/etc/version.lock.json +++ b/detection_rules/etc/version.lock.json @@ -100,9 +100,9 @@ }, "02bab13d-fb14-4d7c-b6fe-4a28874d37c5": { "rule_name": "Potential Ransomware Note File Dropped via SMB", - "sha256": "ab12d69ccda9b4506285fbb564f8ce128934caa2d2f9710e9e95f3302456f364", + "sha256": "c09424400f8baab1bc7e15018527a7b26314073d02a79aac933a265ba32a2bf5", "type": "eql", - "version": 2 + "version": 3 }, "02ea4563-ec10-4974-b7de-12e65aa4f9b3": { "rule_name": "Dumping Account Hashes via Built-In Commands", @@ -1016,9 +1016,9 @@ }, "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1": { "rule_name": "Suspicious Inter-Process Communication via Outlook", - "sha256": "eb4c56089e3f5a64944ea09016b315e24d78a78381989d1d29939502318b82f1", + "sha256": "181668624cb2b4bcc36606deec8dd31b109407ea7b1591438578d01cdce15dce", "type": "eql", - "version": 6 + "version": 7 }, "1defdd62-cd8d-426e-a246-81a37751bb2b": { "rule_name": "Execution of File Written or Modified by PDF Reader", @@ -1062,9 +1062,9 @@ }, "1e6363a6-3af5-41d4-b7ea-d475389c0ceb": { "rule_name": "Creation of SettingContent-ms Files", - "sha256": "411958937e7a1d399c000c3ee9bc6e256d0b92a5aea3474e468b84f5991e8bed", + "sha256": "2d27856788bfc038da39a37ddfd4558b1684b31ac76f695a6303857b37585811", "type": "eql", - "version": 3 + "version": 4 }, "1e9b271c-8caa-4e20-aed8-e91e34de9283": { "rule_name": "First Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT)", @@ -1321,9 +1321,9 @@ }, "26f68dba-ce29-497b-8e13-b4fde1db5a2d": { "rule_name": "Attempts to Brute Force a Microsoft 365 User Account", - "sha256": "d82f7cdce5ff254cd1b94e2f0390bef570efef35250410982b52a2614113ed42", - "type": "threshold", - "version": 208 + "sha256": "9b41ccb00b782e98cb82660d5d90f3b1e1ee827ddd9194e82daa88bbf8f8f665", + "type": "esql", + "version": 209 }, "27071ea3-e806-4697-8abc-e22c92aa4293": { "min_stack_version": "8.12", @@ -1600,9 +1600,9 @@ }, "2e311539-cd88-4a85-a301-04f38795007c": { "rule_name": "Accessing Outlook Data Files", - "sha256": "d2e5a15c87b68da8ded83c3f04fd1cc0b2f38a858d9d58825ea43aa5b4d13c9d", + "sha256": "a30ab7ce03863b4c455dbad0cdcdf5fa65edbe83b132873f3cbcc0aa56b3fe77", "type": "eql", - "version": 2 + "version": 3 }, "2e56e1bc-867a-11ee-b13e-f661ea17fbcd": { "min_stack_version": "8.13", @@ -1940,9 +1940,9 @@ }, "3838e0e3-1850-4850-a411-2e8c5ba40ba8": { "rule_name": "Network Connection via Certutil", - "sha256": "6f47f5ed6240c55d50a34719a69f8cc06e2e1a96b3d7dbf8caed23d34f6fb612", + "sha256": "bd81a89f08fb4259a56c130fd500773f4e8b91d4f27b01f56aac643d845883e4", "type": "eql", - "version": 111 + "version": 112 }, "38948d29-3d5d-42e3-8aec-be832aaaf8eb": { "rule_name": "Prompt for Credentials with OSASCRIPT", @@ -2331,6 +2331,12 @@ "type": "query", "version": 103 }, + "4577ef08-61d1-4458-909f-25a4b10c87fe": { + "rule_name": "AWS RDS DB Snapshot Shared with Another Account", + "sha256": "97a9bbc07dad0412d494a96fa565a7e2555e661c1e57eb06101029572ccf891a", + "type": "eql", + "version": 1 + }, "45ac4800-840f-414c-b221-53dd36a5aaf7": { "rule_name": "Windows Event Logs Cleared", "sha256": "fc09cce15ed08c912228c02d8c8a913febbcfde1263a2410a281a5b780cbc1bd", @@ -2399,9 +2405,9 @@ }, "48819484-9826-4083-9eba-1da74cd0eaf2": { "rule_name": "Suspicious Microsoft 365 Mail Access by ClientAppId", - "sha256": "f73503ecaa32737163abde02d9b27f8d420df219be75d6ce12c1790c04f52a91", + "sha256": "33e3379959ca6f93326f5069bb4e5104c77c30f399d41fdb0108d3f4de3d7444", "type": "new_terms", - "version": 106 + "version": 107 }, "48b3d2e3-f4e8-41e6-95e6-9b2091228db3": { "rule_name": "Potential Reverse Shell", @@ -2609,9 +2615,9 @@ }, "51176ed2-2d90-49f2-9f3d-17196428b169": { "rule_name": "Windows System Information Discovery", - "sha256": "e7f81d69a9300bde47134faf67e74e663bf52d62682494acfafebc8afa114273", + "sha256": "5fc1086cb7ed0f2645c18f7164208710ed010261b5742972ab3198c01be33fb8", "type": "eql", - "version": 4 + "version": 5 }, "5124e65f-df97-4471-8dcb-8e3953b3ea97": { "rule_name": "Hidden Files and Directories via Hidden Flag", @@ -2754,9 +2760,9 @@ }, "53dedd83-1be7-430f-8026-363256395c8b": { "rule_name": "Binary Content Copy via Cmd.exe", - "sha256": "5932e2f55f6f1e70ca53785865b24d7c502633270fe5df05d898167c0c36ab43", + "sha256": "a7b645ba7111f5db7db8a66d481d9d10e4d8207bcd39e3d29e085a9d847a5527", "type": "eql", - "version": 3 + "version": 4 }, "54902e45-3467-49a4-8abc-529f2c8cfb80": { "rule_name": "Uncommon Registry Persistence Change", @@ -2899,9 +2905,9 @@ }, "57bccf1d-daf5-4e1a-9049-ff79b5254704": { "rule_name": "File Staged in Root Folder of Recycle Bin", - "sha256": "8529bac526d51a184db69b13d9f15bf676bc2b0c6152f40ae73019f4dc20c408", + "sha256": "97930f97d8510a9f34e6fa5a686f90deaa7d039bbe8c97b274463538bea0bb4c", "type": "eql", - "version": 3 + "version": 4 }, "57bfa0a9-37c0-44d6-b724-54bf16787492": { "rule_name": "DNS Global Query Block List Modified or Disabled", @@ -3258,6 +3264,12 @@ "type": "query", "version": 6 }, + "63e381a6-0ffe-4afb-9a26-72a59ad16d7b": { + "rule_name": "Sensitive Registry Hive Access via RegBack", + "sha256": "417b0c6af6df3823e5c27b53ae2f2e9eb7eb16e6f01f91427f7abb1d180c9885", + "type": "eql", + "version": 1 + }, "63e65ec3-43b1-45b0-8f2d-45b34291dc44": { "rule_name": "Network Connection via Signed Binary", "sha256": "a46c6b82143566c72c64c8288c549942594363613f856106a1b1e22b529caf49", @@ -3721,9 +3733,9 @@ }, "71bccb61-e19b-452f-b104-79a60e546a95": { "rule_name": "Unusual File Creation - Alternate Data Stream", - "sha256": "a3fdba9254d6e0decace5b3bbe34f7365bdb09fb0ab62ce49b0058dc63af0cbc", + "sha256": "b88514bbe2cf6ea8319648c67d83c00801179f31734024fd4661549db9e00297", "type": "eql", - "version": 114 + "version": 115 }, "71c5cb27-eca5-4151-bb47-64bc3f883270": { "rule_name": "Suspicious RDP ActiveX Client Loaded", @@ -3980,9 +3992,9 @@ }, "78e9b5d5-7c07-40a7-a591-3dbbf464c386": { "rule_name": "Suspicious File Renamed via SMB", - "sha256": "c611056d35cd93fe81c5d897466610121a8eb8824ced600673490ea40deaba6d", + "sha256": "b06fe72841e973c578410fa85cc532be47a7199c613e59e094aaefce1e311a48", "type": "eql", - "version": 2 + "version": 3 }, "78ef0c95-9dc2-40ac-a8da-5deb6293a14e": { "rule_name": "Unsigned DLL Loaded by Svchost", @@ -4064,9 +4076,9 @@ }, "7bcbb3ac-e533-41ad-a612-d6c3bf666aba": { "rule_name": "Tampering of Shell Command-Line History", - "sha256": "106aa939e4c87db6570ee327ed6ca3e7f889aca17a71e09044b0b8dc3bed815c", + "sha256": "049a63c5b82b17f2d6c5dd181badc64cc229ff7a1273b26c54a8703a0514f8db", "type": "eql", - "version": 105 + "version": 106 }, "7c2e1297-7664-42bc-af11-6d5d35220b6b": { "rule_name": "APT Package Manager Configuration File Creation", @@ -4107,9 +4119,9 @@ }, "7df3cb8b-5c0c-4228-b772-bb6cd619053c": { "rule_name": "SSH Key Generated via ssh-keygen", - "sha256": "2db05f2e3ae056597ccc0da7403d1957ce361a9175866efd0c7e540914d0fded", + "sha256": "90b5e320db9401bdd0376dab7ae156178fbe41dfe70edf6fe1e1f02626127276", "type": "eql", - "version": 1 + "version": 2 }, "7dfaaa17-425c-4fe7-bd36-83705fde7c2b": { "rule_name": "Suspicious Kworker UID Elevation", @@ -4118,11 +4130,20 @@ "version": 2 }, "7e23dfef-da2c-4d64-b11d-5f285b638853": { - "min_stack_version": "8.9", + "min_stack_version": "8.12", + "previous": { + "8.9": { + "max_allowable_version": 102, + "rule_name": "Microsoft Management Console File from Unusual Path", + "sha256": "a3c1779146ac37db61c960f0dd8090df03ff5ca4d862a830cb4f276b73ad4a49", + "type": "eql", + "version": 3 + } + }, "rule_name": "Microsoft Management Console File from Unusual Path", "sha256": "adb75f0219164c5e3c96a145f69d0da86658f728ce7ced78350c0b40f97eb464", "type": "eql", - "version": 2 + "version": 103 }, "7f370d54-c0eb-4270-ac5a-9a6020585dc6": { "rule_name": "Suspicious WMIC XSL Script Execution", @@ -4145,9 +4166,9 @@ "7fda9bb2-fd28-11ee-85f9-f661ea17fbce": { "min_stack_version": "8.13", "rule_name": "Potential AWS S3 Bucket Ransomware Note Uploaded", - "sha256": "a98fe6d999a2909e15b551344bcf8abf4c8755341d7daa2ddc121fbdd0f3eec2", + "sha256": "e67b6224776547e16d7ad98038f463469fe254811509c279e254f182d16da5c2", "type": "esql", - "version": 1 + "version": 2 }, "80084fa9-8677-4453-8680-b891d3c0c778": { "rule_name": "Enumeration of Kernel Modules via Proc", @@ -4161,6 +4182,12 @@ "type": "eql", "version": 4 }, + "8025db49-c57c-4fc0-bd86-7ccd6d10a35a": { + "rule_name": "Potential PowerShell Obfuscated Script", + "sha256": "3750bd0f420e04cc5b48056c7e39fda3d29f6f4d5427f19dfbae2a2d94dbb8b5", + "type": "query", + "version": 1 + }, "804a7ac8-fc00-11ee-924b-f661ea17fbce": { "min_stack_version": "8.9", "rule_name": "SSM Session Started to EC2 Instance", @@ -4562,9 +4589,9 @@ }, "8eec4df1-4b4b-4502-b6c3-c788714604c9": { "rule_name": "Bitsadmin Activity", - "sha256": "39ca4c3ed7500f428501bf32d7b5361c687e94b712b9d7742406bb4c804bb53b", + "sha256": "35fb8f0b0b8dc7f267f657ff3e2bed84da9697e91d1b78c4aa6fefab084e96e7", "type": "eql", - "version": 2 + "version": 3 }, "8f242ffb-b191-4803-90ec-0f19942e17fd": { "rule_name": "Potential ADIDNS Poisoning via Wildcard Record Creation", @@ -5140,6 +5167,12 @@ "type": "machine_learning", "version": 104 }, + "9efb3f79-b77b-466a-9fa0-3645d22d1e7f": { + "rule_name": "AWS RDS DB Instance Made Public", + "sha256": "17ecf0959839ce503bd007ec83692ce66c8030a9fb479e52cf63f27f40bce235", + "type": "eql", + "version": 1 + }, "9f1c4ca3-44b5-481d-ba42-32dc215a2769": { "rule_name": "Potential Protocol Tunneling via EarthWorm", "sha256": "0acdc01e1894806e1b2e1a96df91a299f0324172f6e08fa06b75cb6244675079", @@ -5238,10 +5271,10 @@ "version": 110 }, "a2795334-2499-11ed-9e1a-f661ea17fbce": { - "rule_name": "Google Workspace Restrictions for Google Marketplace Modified to Allow Any App", - "sha256": "89b0c47b77b31a2b7c84dfe6195e371e6678e7153a116dd44c14e22eae50b16c", + "rule_name": "Google Workspace Restrictions for Marketplace Modified to Allow Any App", + "sha256": "f88225fa0fa8f945e8a2c742913108af721f807ca41fe1e300d3d6546236bcd2", "type": "query", - "version": 106 + "version": 107 }, "a2d04374-187c-4fd9-b513-3ad4e7fdd67a": { "rule_name": "PowerShell Mailbox Collection Script", @@ -5340,6 +5373,12 @@ "type": "eql", "version": 110 }, + "a83b3dac-325a-11ef-b3e6-f661ea17fbce": { + "rule_name": "Entra ID Device Code Auth with Broker Client", + "sha256": "1cf36e99756517a71c3c4daeef8d7ed86213399d94ede19cb11a01ad05ef7323", + "type": "query", + "version": 1 + }, "a87a4e42-1d82-44bd-b0bf-d9b7f91fb89e": { "rule_name": "Web Application Suspicious Activity: POST Request Declined", "sha256": "ebfc9e780da093a1ff6bd51cae7eafadee5cf30f6044a85add7779f17d924a88", @@ -5431,6 +5470,13 @@ "type": "eql", "version": 111 }, + "ab8f074c-5565-4bc4-991c-d49770e19fc9": { + "min_stack_version": "8.13", + "rule_name": "AWS S3 Object Encryption Using External KMS Key", + "sha256": "9cb68a665ab8fb65cda28c7f6d955319eae1629b493c01c6bc144c5ceb04ffd1", + "type": "esql", + "version": 1 + }, "abae61a8-c560-4dbd-acca-1e1438bff36b": { "rule_name": "Unusual Windows Process Calling the Metadata Service", "sha256": "e47f2af768f5f8d5ebfcdad5c838efe410a8712405d61d5d3d4786000bd6e676", @@ -5491,10 +5537,10 @@ "version": 108 }, "acbc8bb9-2486-49a8-8779-45fb5f9a93ee": { - "rule_name": "Google Workspace API Access Granted via Domain-Wide Delegation of Authority", - "sha256": "dff7c67640bd01423d897e090d914f6661f2ccbd00d363315a58d011cac71b65", + "rule_name": "Google Workspace API Access Granted via Domain-Wide Delegation", + "sha256": "c387b952f7259ac6c595aba8c0f9182063b9497dd22302e8b1d3bcd1e582de79", "type": "query", - "version": 205 + "version": 206 }, "acd611f3-2b93-47b3-a0a3-7723bcc46f6d": { "rule_name": "Potential Command and Control via Internet Explorer", @@ -5671,6 +5717,12 @@ "type": "machine_learning", "version": 104 }, + "b36c99af-b944-4509-a523-7e0fad275be1": { + "rule_name": "AWS RDS Snapshot Deleted", + "sha256": "8b76484fc36e6fadcda9a04a2159138a7848fea3ac58faa33232daf8efb18d03", + "type": "eql", + "version": 1 + }, "b41a13c6-ba45-4bab-a534-df53d0cfed6a": { "rule_name": "Suspicious Endpoint Security Parent Process", "sha256": "eef346faba690b1ca2c851bf022d97d9087f5626a0d024a6714c3d09e9ba26d0", @@ -6027,9 +6079,9 @@ }, "bd3d058d-5405-4cee-b890-337f09366ba2": { "rule_name": "Potential Defense Evasion via CMSTP.exe", - "sha256": "f9a5163bfb60ec1ac26ac681518a193a85b03a87dac342a3579a7b2ae3628e0b", + "sha256": "9a43bf8c991e44191f2acddfa4de48dc8498f1fb4a31f0a465da7803607b88e9", "type": "eql", - "version": 2 + "version": 3 }, "bd7eefee-f671-494e-98df-f01daf9e5f17": { "rule_name": "Suspicious Print Spooler Point and Print DLL", @@ -6068,10 +6120,10 @@ "version": 109 }, "bf1073bf-ce26-4607-b405-ba1ed8e9e204": { - "rule_name": "AWS RDS Snapshot Restored", - "sha256": "867302d2c993c7e6bb06acb3bb9784e8de51117e6d0fdd1a5a8e040e24fab59f", - "type": "query", - "version": 206 + "rule_name": "AWS RDS DB Instance Restored", + "sha256": "0703a09b818a7309df61f2173cfadcdd04899c0f597c70caebec0a6a7a077968", + "type": "eql", + "version": 207 }, "bf8c007c-7dee-4842-8e9a-ee534c09d205": { "rule_name": "System Owner/User Discovery Linux", @@ -6226,15 +6278,15 @@ }, "c55badd3-3e61-4292-836f-56209dc8a601": { "rule_name": "Attempted Private Key Access", - "sha256": "92447cf8bb6de4a626ecd420b9c64922484cb49f216d13292e833c1abdb4786c", + "sha256": "a2d23373933dc72a8fac22e848478c79809b64fb82b1e2df5411efd914a02daa", "type": "eql", - "version": 3 + "version": 4 }, "c5677997-f75b-4cda-b830-a75920514096": { "rule_name": "Service Path Modification via sc.exe", - "sha256": "6d70ac346b080bca5ad2083c56ff66bd01f63204483b047353855e7898b39862", + "sha256": "d21521b9419d33d88ccc37d41184f3f1c212c72630806481b83b8ec03e10e97e", "type": "eql", - "version": 3 + "version": 4 }, "c57f8579-e2a5-4804-847f-f2732edc5156": { "rule_name": "Potential Remote Desktop Shadowing Activity", @@ -6455,11 +6507,20 @@ "version": 106 }, "cc382a2e-7e52-11ee-9aac-f661ea17fbcd": { - "min_stack_version": "8.10", - "rule_name": "Multiple Okta Client Addresses for a Single User Session", - "sha256": "1fd88b6e7c9bf6b2176da46f28e40a91cff9746a635071e899bf47a6176021a5", - "type": "threshold", - "version": 2 + "min_stack_version": "8.13", + "previous": { + "8.10": { + "max_allowable_version": 101, + "rule_name": "Multiple Okta Client Addresses for a Single User Session", + "sha256": "1fd88b6e7c9bf6b2176da46f28e40a91cff9746a635071e899bf47a6176021a5", + "type": "threshold", + "version": 2 + } + }, + "rule_name": "Multiple Device Token Hashes for Single Okta Session", + "sha256": "1ff1f2a88a1700579b30e869574672a0f8a4a59710be9c14164041681731b380", + "type": "esql", + "version": 102 }, "cc653d77-ddd2-45b1-9197-c75ad19df66c": { "rule_name": "Potential Data Exfiltration Activity to an Unusual IP Address", @@ -6589,6 +6650,12 @@ "type": "query", "version": 111 }, + "cdf1a39b-1ca5-4e2a-9739-17fc4d026029": { + "rule_name": "Shadow File Modification", + "sha256": "81f59855dd3863c54604646a10250287d80095942c3a3bc9eee85d811a248f72", + "type": "eql", + "version": 1 + }, "ce08b55a-f67d-4804-92b5-617b0fe5a5b5": { "rule_name": "First Occurrence GitHub Event for a Personal Access Token (PAT)", "sha256": "557be18d473f0dab21314e36e19724bf288eed2289446960d75923b23429b4ca", @@ -6816,9 +6883,9 @@ }, "d68e95ad-1c82-4074-a12a-125fe10ac8ba": { "rule_name": "System Information Discovery via Windows Command Shell", - "sha256": "e564b576c629a29ec8088864b78c7c81c8d46453cc5e038a33fdd24d4a3a2641", + "sha256": "48076f4a909ea3f9abf572fc3180287a6d83b02bb0f84aa4ea5b11fb9f93a2d1", "type": "eql", - "version": 10 + "version": 11 }, "d68eb1b5-5f1c-4b6d-9e63-5b6b145cd4aa": { "rule_name": "Microsoft 365 Exchange Anti-Phish Policy Deletion", @@ -7785,11 +7852,17 @@ "type": "query", "version": 2 }, + "f2015527-7c46-4bb9-80db-051657ddfb69": { + "rule_name": "AWS RDS DB Instance or Cluster Password Modified", + "sha256": "e6460a31449c23f8abfc491157dd710febce134e74e0b2a94674e4238594f31f", + "type": "eql", + "version": 1 + }, "f243fe39-83a4-46f3-a3b6-707557a102df": { "rule_name": "Service Path Modification", - "sha256": "f6488872c8be23ecc9a4e3339d5de39339210c77856be3d05d90c00968a721c9", + "sha256": "6a7bad61674e33450053730006659a7d557c3faee437029c328754e645def6bc", "type": "eql", - "version": 2 + "version": 3 }, "f24bcae1-8980-4b30-b5dd-f851b055c9e7": { "rule_name": "Creation of Hidden Login Item via Apple Script", @@ -7822,10 +7895,10 @@ "version": 206 }, "f33e68a4-bd19-11ed-b02f-f661ea17fbcc": { - "rule_name": "Google Workspace Object Copied from External Drive and Access Granted to Custom Application", - "sha256": "bf31263ee7b3dd377aad879072d95f3cfa5f487f3db9f91e6d47822700c554c9", + "rule_name": "Google Workspace Object Copied to External Drive with App Consent", + "sha256": "18b327ef6f413b2cb43af2cf759d7cc99e9e0a560008ea0cf27fd3c329ff1ce7", "type": "eql", - "version": 4 + "version": 5 }, "f3403393-1fd9-4686-8f6e-596c58bc00b4": { "rule_name": "Machine Learning Detected a DNS Request Predicted to be a DGA Domain", @@ -7926,9 +7999,9 @@ }, "f59668de-caa0-4b84-94c1-3a1549e1e798": { "rule_name": "WMIC Remote Command", - "sha256": "49fe04b88dc0dc6ee9776c88113935db33ecbc3c955ddb4b201acb6867022d7f", + "sha256": "4bed051c9dd04e9af8e3a2e7e5b745d2c9e666d5041466fe01e618f2e9aa3a90", "type": "eql", - "version": 4 + "version": 5 }, "f5c005d3-4e17-48b0-9cd7-444d48857f97": { "rule_name": "Setcap setuid/setgid Capability Set", @@ -7960,6 +8033,12 @@ "type": "eql", "version": 110 }, + "f6652fb5-cd8e-499c-8311-2ce2bb6cac62": { + "rule_name": "AWS RDS DB Instance or Cluster Deletion Protection Disabled", + "sha256": "5d49105f2099fe1c95a69e97a0bc950a38fa1c2c94f564b11948f80c348c3513", + "type": "eql", + "version": 1 + }, "f675872f-6d85-40a3-b502-c0d2ef101e92": { "rule_name": "Delete Volume USN Journal with Fsutil", "sha256": "6b1d419bf9aa6949ee92ded6a11fd322e88da4c01130617ee0d215449c773841", @@ -8281,9 +8360,9 @@ }, "ff4599cb-409f-4910-a239-52e4e6f532ff": { "rule_name": "LSASS Process Access via Windows API", - "sha256": "6b4878af88365170479ac74ad0afcc51029ed6448d58fcb9f720bb70d9f25c45", + "sha256": "9a60c969dcfdec4a4768f18d3d13d2f00acd9243d6c791a967a0515aa7917bec", "type": "eql", - "version": 8 + "version": 9 }, "ff4dd44a-0ac6-44c4-8609-3f81bc820f02": { "rule_name": "Microsoft 365 Exchange Transport Rule Creation",